CVE-2026-22818

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22818", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T22:50:10.289Z", "datePublished": "2026-01-13T19:49:52.042Z", "dateUpdated": "2026-01-15T15:29:39.849Z"}, "containers": {"cna": {"title": "JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks \"alg\" (untrusted header.alg fallback)", "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4"}, {"name": "https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134", "tags": ["x_refsource_MISC"], "url": "https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134"}], "affected": [{"vendor": "honojs", "product": "hono", "versions": [{"version": "< 4.11.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-13T19:49:52.042Z"}, "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono\u2019s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4."}], "source": {"advisory": "GHSA-3vhc-576x-3qv4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-15T15:29:32.068668Z", "id": "CVE-2026-22818", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T15:29:39.849Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22818", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-15T15:29:32.068668Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T15:29:36.877Z"}}], "cna": {"title": "JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks \"alg\" (untrusted header.alg fallback)", "source": {"advisory": "GHSA-3vhc-576x-3qv4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "honojs", "product": "hono", "versions": [{"status": "affected", "version": "< 4.11.4"}]}], "references": [{"url": "https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4", "name": "https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134", "name": "https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono\u2019s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-13T19:49:52.042Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22818", "state": "PUBLISHED", "dateUpdated": "2026-01-15T15:29:39.849Z", "dateReserved": "2026-01-09T22:50:10.289Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-13T19:49:52.042Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hono", "vendor": "honojs", "versions": [{"status": "affected", "version": "< 4.11.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "0D4B47C2-4F12-40CF-B9D0-51EC76A81F36", "versionEndExcluding": "4.11.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono\u2019s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4."}, {"lang": "es", "value": "Hono es un framework de aplicaci\u00f3n web que proporciona soporte para cualquier entorno de ejecuci\u00f3n de JavaScript. Antes de la versi\u00f3n 4.11.4, existe una falla en el middleware de verificaci\u00f3n JWT de JWK/JWKS de Hono que permit\u00eda que el algoritmo especificado en la cabecera JWT influyera en la verificaci\u00f3n de la firma cuando el JWK seleccionado no defin\u00eda expl\u00edcitamente un algoritmo. Esto podr\u00eda habilitar la confusi\u00f3n de algoritmos JWT y, en ciertas configuraciones, permitir que se aceptaran tokens falsificados. El middleware de verificaci\u00f3n JWT de JWK/JWKS ha sido actualizado para requerir una lista de permitidos expl\u00edcita de algoritmos asim\u00e9tricos al verificar tokens. El middleware ya no deriva el algoritmo de verificaci\u00f3n de valores de cabecera JWT no confiables. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.11.4."}], "id": "CVE-2026-22818", "lastModified": "2026-06-17T10:20:29.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22818", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-15T15:29:32.068668Z", "version": "2.0.3"}}]}, "published": "2026-01-13T20:16:11.740", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:32:19.717872+00:00", "value": {"mitigation_remediation": ["Upgrade the Hono framework to version 4.11.4 or later to enforce an explicit allowlist of asymmetric algorithms in JWT verification.", "Configure the middleware\u2019s algorithm allowlist to include only strongly secure asymmetric algorithms (e.g., RS256, ES256) when deploying the application.", "Audit existing JWT authentication endpoints to ensure they reject tokens lacking an \"alg\" claim defined in the associated JWK."], "summary": {"action": "Patch", "impact": "JWT Algorithm Confusion Allowing Forged Token Acceptance"}, "threat_synthesis": {"affected_systems": "The vulnerability affects applications built with the Hono JavaScript web framework prior to version 4.11.4. Any deployment that relies on the default JWT verification middleware without explicit configuration of an allowed algorithm list is susceptible. No specific operating system or runtime environment is required beyond those that host Hono with a compatible JavaScript runtime.", "description_and_impact": "The flaw in the Hono framework\u2019s JWK/JWKS JWT verification middleware permits the algorithm declared in the JWT header to dictate the signature verification process when the chosen JSON Web Key does not explicitly define an algorithm. This misconfiguration enables an attacker to craft a token that specifies a weaker or undesired algorithm and have it accepted by the middleware, effectively allowing the creation of forged tokens that may be treated as legitimate credentials.", "risk_and_exploitability": "The vulnerability receives a CVSS score of 8.2, indicating a high impact on confidentiality and authentication. The EPSS score is under 1%, suggesting that while a possible exploitation exists, real-world leverage is currently limited. The issue is not listed in the CISA KEV catalog. Attackers would need to send a crafted JWT containing a manipulated algorithm field to a vulnerable application\u2019s protected route; if the middleware falls back to using header.alg without validation, the token would be accepted and grant access. No special dependencies or unprivileged access are required beyond reaching the authentication endpoint."}}}}, "created": "2026-01-14T11:08:08.634551+00:00", "updated": "2026-04-18T06:45:23.955191+00:00", "vendors": ["hono", "hono$PRODUCT$hono"]}