{"id":"GO-2026-5872","revision":"fe56881a05a84248bfbde2642b6f11de","records":[{"revision":"fe56881a05a84248bfbde2642b6f11de","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5872","aliases":["CVE-2026-49998","GHSA-g6vg-wj8f-48cj"],"title":"Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass in github.com/centrifugal/centrifugo","description":"Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass in github.com/centrifugal/centrifugo","state":0,"publishedAt":"2026-07-07T15:26:37+00:00","modifiedAt":"2026-07-07T16:01:31.6787825+00:00","affected":[{"ecosystem":"Go","name":"github.com/centrifugal/centrifugo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/centrifugal/centrifugo/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/centrifugal/centrifugo/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/centrifugal/centrifugo/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/centrifugal/centrifugo/v6","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.8.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5872","license":"OSV · upstream source license applies","key":"osv:GO-2026-5872","identifiers":["GO-2026-5872","CVE-2026-49998","GHSA-g6vg-wj8f-48cj"]},"retained":false,"historicalAffected":[]}],"coverage":[]}