Description
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace, affecting client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, and internal/jwks/manager.go. This issue is fixed in version 6.8.1.
Severity (CVSS)
| Base score | 8.2 |
|---|---|
| Severity | High |
| Version | CVSS 3.1 |
| Vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N |
| Provided by | CNA |
Weaknesses
- CWE-347 — CWE-347: Improper Verification of Cryptographic Signature
Affected products
| Vendor | Product | Versions |
|---|---|---|
| centrifugal | centrifugo | < 6.8.1 |
References
- https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj (x_refsource_CONFIRM)
- https://github.com/centrifugal/centrifugo/pull/1142 (x_refsource_MISC)
- https://github.com/centrifugal/centrifugo/commit/15d785015c6f318c1b68ea40b813699c9f8bd2c4 (x_refsource_MISC)
- https://github.com/centrifugal/centrifugo/releases/tag/v6.8.1 (x_refsource_MISC)
Generated from the official CVE List on 17 Jul 2026 07:01 UTC.