CVE-2026-49998: falha de alta gravidade em centrifugal centrifugo
Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.2%
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace, affecting client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, and internal/jwks/manager.go. This issue is fixed in version 6.8.1.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Produtos afetados
centrifugal · centrifugoCVEs relacionadas — centrifugal centrifugo
No mesmo produto, das mais perigosas para as menos.
CVE-2026-71485CRITICALCentrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backendsEPSS 0.6%CVE-2026-62963HIGHCentrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transportEPSS 0.5%CVE-2026-32301CRITICALCentrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URLEPSS 0.3%