CVE-2026-49998
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In Centrifugo before version 6.8.1, dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer. This occurred because the JWKS cache and singleflight lookup were keyed only by the JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace.
Risk Assessment
The organization is at risk that a JWT token issued by one trusted issuer could be used to access resources intended for another issuer, potentially leading to unauthorized access to data or functions.
Recommendation
Immediately update Centrifugo to version 6.8.1 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Centrifugo
See all- CVE-2026-71485Critical
Centrifugo before version 6.9.0 allows a remote client to spoof headers such as x-trusted-user in connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The vulnerability arises from copying client-controlled headers into the connection context and forwarding them as trusted backend headers.
- CVE-2026-62963High
In Centrifugo before version 6.8.4, the unidirectional WebSocket transport with compression enabled enforced message size limit before decompression, but after decompression there was no output cap. This allowed unauthenticated requests to /connection/uni_websocket to trigger high memory and CPU consumption.
Original NVD description (English source)
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace, affecting client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, and internal/jwks/manager.go. This issue is fixed in version 6.8.1.