{"id":"CVE-2025-65730","aliases":["EUVD-2025-201412","GHSA-6xgv-g9h7-chvc"],"status":"published","title":"Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a...","description":"Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.0055,"percentile":0.46275,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-798"],"published":"2025-12-05T00:00:00Z","modified":"2026-11-04T22:10:00Z","products":[{"vendor":"pommee","product":"goaway"}],"references":[{"url":"https://github.com/pommee/goaway/releases/tag/v0.62.16","tags":["Release Notes","web"]},{"url":"https://github.com/pommee/goaway/blob/v0.62.18/backend/api/middleware.go#L15","tags":["Product","web"]},{"url":"https://github.com/pommee/goaway/blob/v0.62.18/backend/api/middleware.go#L110","tags":["Product","web"]},{"url":"https://github.com/pommee/goaway/blob/v0.62.18/backend/api/middleware.go#L69","tags":["Product","web"]},{"url":"https://github.com/pommee/goaway/blob/v0.62.18/backend/api/auth.go#L48","tags":["Product","web"]},{"url":"https://github.com/pommee/goaway/blob/v0.62.18/backend/api/middleware.go#L88","tags":["Product","web"]},{"url":"https://github.com/pommee/goaway/blob/v0.62.18/backend/api/middleware.go#L40","tags":["Product","web"]},{"url":"https://github.com/pommee/goaway/commit/5769f8782b7453ca1c22a201b224b5ce48532f64#diff-4ddfd6cf1311ddfd45734bb1dc53bc208df69584ba92ac4f38866bd558434678L15-L40","tags":["Product","fix"]},{"url":"https://github.com/gian2dchris/CVEs/tree/CVE-2025-65730/CVE-2025-65730","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65730","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6xgv-g9h7-chvc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65730.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-65730","description":"Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.","status":"published","published":"2025-12-05T00:00:00Z","modified":"2025-12-08T16:49:56.405Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:32:26.64278Z"}],"euvd":[{"id":"EUVD-2025-201412","description":"Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.","status":"published","published":"2025-12-05T00:00:00Z","modified":"2025-12-08T16:49:56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:09.057321Z"}],"ghsa":[{"id":"GHSA-6xgv-g9h7-chvc","title":"Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a...","description":"Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.","status":"published","published":"2025-12-05T18:31:11Z","modified":"2025-12-08T18:31:36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T15:05:05.469565Z"}],"nvd":[{"id":"CVE-2025-65730","description":"Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.","status":"published","published":"2025-12-05T16:15:50.773Z","modified":"2026-11-04T22:10:00.21Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-798"],"updated_at":"2026-11-04T23:43:37.864413Z"}],"osv":[{"id":"CVE-2025-65730","description":"Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.","status":"published","published":"2025-12-05T00:00:00Z","modified":"2026-11-05T21:16:02.931295433Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T22:00:58.054534Z"}]}}