CVE-2025-65730: Pommee Goaway

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.

Affected products

• Pommee Goaway: before 0.62.19 (fixed in 0.62.19)

Published 2025-12-05. Last modified 2026-06-17.