CVE-2026-49998

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49998", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-02T18:30:51.283Z", "datePublished": "2026-07-16T19:33:33.147Z", "dateUpdated": "2026-07-17T11:13:39.150Z"}, "containers": {"cna": {"title": "Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj"}, {"name": "https://github.com/centrifugal/centrifugo/pull/1142", "tags": ["x_refsource_MISC"], "url": "https://github.com/centrifugal/centrifugo/pull/1142"}, {"name": "https://github.com/centrifugal/centrifugo/commit/15d785015c6f318c1b68ea40b813699c9f8bd2c4", "tags": ["x_refsource_MISC"], "url": "https://github.com/centrifugal/centrifugo/commit/15d785015c6f318c1b68ea40b813699c9f8bd2c4"}, {"name": "https://github.com/centrifugal/centrifugo/releases/tag/v6.8.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/centrifugal/centrifugo/releases/tag/v6.8.1"}], "affected": [{"vendor": "centrifugal", "product": "centrifugo", "versions": [{"version": "< 6.8.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-16T19:33:33.147Z"}, "descriptions": [{"lang": "en", "value": "Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace, affecting client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, and internal/jwks/manager.go. This issue is fixed in version 6.8.1."}], "source": {"advisory": "GHSA-g6vg-wj8f-48cj", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-17T11:13:16.710942Z", "id": "CVE-2026-49998", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T11:13:39.150Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49998", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-17T11:13:16.710942Z"}}}], "references": [{"url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T11:13:34.674Z"}}], "cna": {"title": "Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass", "source": {"advisory": "GHSA-g6vg-wj8f-48cj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "centrifugal", "product": "centrifugo", "versions": [{"status": "affected", "version": "< 6.8.1"}]}], "references": [{"url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj", "name": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/centrifugal/centrifugo/pull/1142", "name": "https://github.com/centrifugal/centrifugo/pull/1142", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/centrifugal/centrifugo/commit/15d785015c6f318c1b68ea40b813699c9f8bd2c4", "name": "https://github.com/centrifugal/centrifugo/commit/15d785015c6f318c1b68ea40b813699c9f8bd2c4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/centrifugal/centrifugo/releases/tag/v6.8.1", "name": "https://github.com/centrifugal/centrifugo/releases/tag/v6.8.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace, affecting client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, and internal/jwks/manager.go. This issue is fixed in version 6.8.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-16T19:33:33.147Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49998", "state": "PUBLISHED", "dateUpdated": "2026-07-17T11:13:39.150Z", "dateReserved": "2026-06-02T18:30:51.283Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-16T19:33:33.147Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "centrifugo", "vendor": "centrifugal", "versions": [{"status": "affected", "version": "< 6.8.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace, affecting client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, and internal/jwks/manager.go. This issue is fixed in version 6.8.1."}, {"lang": "es", "value": "Centrifugo es un servidor de mensajer\u00eda en tiempo real escalable de c\u00f3digo abierto. Antes de 6.8.1, la verificaci\u00f3n din\u00e1mica de puntos finales JWKS de Centrifugo podr\u00eda reutilizar una clave para un emisor permitido para verificar un JWT para otro emisor permitido porque la cach\u00e9 JWKS y la b\u00fasqueda singleflight se indexaban solo por el kid del encabezado JWT, no por el punto final JWKS resuelto, el emisor, la audiencia o el espacio de nombres del dominio de confianza, afectando a client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, e internal/jwks/manager.go. Este problema est\u00e1 solucionado en la versi\u00f3n 6.8.1."}], "id": "CVE-2026-49998", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49998", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-17T11:13:16.710942Z", "version": "2.0.3"}}]}, "published": "2026-07-16T20:16:45.290", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/centrifugal/centrifugo/commit/15d785015c6f318c1b68ea40b813699c9f8bd2c4"}, {"source": "security-advisories@github.com", "url": "https://github.com/centrifugal/centrifugo/pull/1142"}, {"source": "security-advisories@github.com", "url": "https://github.com/centrifugal/centrifugo/releases/tag/v6.8.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.8.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "centrifugo", "source": "cna", "vendor": "centrifugal"}, "product": "centrifugo", "vendor": "centrifugal"}], "created": "2026-07-16T20:30:05.156988+00:00", "updated": "2026-07-31T01:30:05.630460+00:00", "vendors": ["centrifugal", "centrifugal$PRODUCT$centrifugo"]}