CVE-2025-65730

HIGH 8.8CVE-2025-65730 · Published 05/12/2025 · updated 04/11/2026

In short

CVE-2025-65730 is a HIGH (CVSS 8.8) vulnerability affecting goaway (pommee).
Chance of exploitation in the next 30 days (EPSS): 0.55%, higher than 46.2% of all vulnerabilities.
Fix: update to 0.62.19 or later.

Package	Affected versions	Patched versions
goaway pommee	`< 0.62.19`	`0.62.19`

Description

Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.

References

gian2dchris/CVEs · Exploit
pommee/goaway · Product
pommee/goaway · Product
pommee/goaway · Product
pommee/goaway · Product
pommee/goaway · Product
pommee/goaway · Product
pommee/goaway commit 5769f87 · Product
pommee/goaway release v0.62.16 · Release Notes

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free