Security Advisory catalog CVE-2026-49998 CVE-2026-49998 Published
Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass Overview Affected History Connections
cve-program · CVE-2026-49998 Published centrifugo Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "centrifugal",
"product": "centrifugo",
"versions": [
{
"version": "< 6.8.1",
"status": "affected"
}
]
}
nvd · CVE-2026-49998 Published No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.
osv · GHSA-g6vg-wj8f-48cj Published github.com/centrifugal/centrifugo/v6 Go
SEMVER · introduced 0 → fixed 6.8.1
github.com/centrifugal/centrifugo/v5 Go
SEMVER · introduced 0 → last_affected 5.4.9
github.com/centrifugal/centrifugo/v4 Go
SEMVER · introduced 0 → last_affected 4.1.5
github.com/centrifugal/centrifugo/v3 Go
SEMVER · introduced 0 → last_affected 3.2.3
github.com/centrifugal/centrifugo Go
SEMVER · introduced 0 → last_affected 2.4.0
osv · GO-2026-5872 Published github.com/centrifugal/centrifugo Go
SEMVER · introduced 0
github.com/centrifugal/centrifugo/v3 Go
SEMVER · introduced 0
github.com/centrifugal/centrifugo/v4 Go
SEMVER · introduced 0
github.com/centrifugal/centrifugo/v5 Go
SEMVER · introduced 0
github.com/centrifugal/centrifugo/v6 Go
SEMVER · introduced 0 → fixed 6.8.1