CVE-2026-72805: Go Jwt Hardcoded Subject Claimcve-2026-72805-go-jwt-hardcoded-subject-claim
The JWT 'sub' (subject) claim is assigned a static string literal rather than a dynamic user identifier. This misconfiguration causes all issued tokens to share the same subject identity, potentially leading to privilege escalation or authorization bypasses.
