CVE-2025-65730

CVE-2025-65730 is an authentication bypass vulnerability stemming from the use of a hardcoded secret for signing JWT tokens in the GoAway application, affecting versions up to v0.62.18. This issue, classified under CWE-798 (Use of Hard-coded Credentials), was published on 2025-12-05 and carries a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability resides in the backend API components, as evidenced by code references in auth.go and middleware.go files within the pommee/goaway repository.

An attacker with adjacent network access (AV:A) can exploit this vulnerability with low complexity and no required privileges or user interaction. By knowing the hardcoded signing secret, the attacker can forge valid JWT tokens to bypass authentication, potentially gaining unauthorized access to the application. Successful exploitation enables high-impact confidentiality, integrity, and availability violations, such as data exfiltration, modification, or denial of service.

Mitigation is available in GoAway version 0.62.19, which addresses the hardcoded secret issue. Security practitioners should immediately upgrade affected instances to this patched version. Relevant code changes and details are documented in the project's GitHub repository at https://github.com/pommee/goaway, with additional analysis in https://github.com/gian2dchris/CVEs/tree/CVE-2025-65730/CVE-2025-65730.