PT-2025-49249 · Goaway · Goaway

Published 2025-12-05 · Updated 2025-12-05 · CVE-2025-65730

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoAway versions prior to 0.62.19

Description The software uses a hardcoded secret for signing JWT (JSON Web Token) tokens used for authentication, leading to an authentication bypass. This allows unauthorized access as the application trusts tokens signed with the known secret.

Recommendations Update to version 0.62.19 or later.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-65730

Affected Products

Goaway

References · 13

• 🔥 https://github.com/gian2dchris/CVEs/tree/CVE-2025-65730/CVE-2025-65730 · Exploit
• https://osv.dev/vulnerability/CVE-2025-65730 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65730 · Security Note
• https://github.com/pommee/goaway/blob/v0.62.18/backend/api/middleware.go#L15 · Note
• https://github.com/pommee/goaway/blob/v0.62.18/backend/api/middleware.go#L110 · Note
• https://github.com/pommee/goaway/blob/v0.62.18/backend/api/auth.go#L48 · Note
• https://github.com/pommee/goaway/blob/v0.62.18/backend/api/middleware.go#L88 · Note
• https://github.com/pommee/goaway/commit/5769f8782b7453ca1c22a201b224b5ce48532f64#diff-4ddfd6cf1311ddfd45734bb1dc53bc208df69584ba92ac4f38866bd558434678L15-L40 · Note
• https://github.com/pommee/goaway/blob/v0.62.18/backend/api/middleware.go#L69 · Note
• https://github.com/pommee/goaway/releases/tag/v0.62.16 · Note
• https://github.com/pommee/goaway/blob/v0.62.18/backend/api/middleware.go#L40 · Note
• https://twitter.com/VulmonFeeds/status/1997048409472057710 · Twitter Post
• https://twitter.com/CVEnew/status/1996969017701974270 · Twitter Post