{"cve":"CVE-2025-62610","nvd":{"published":"2025-10-22T20:15:38.207","modified":"2026-10-08T11:10:00.250","status":"Analyzed","description":"Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud (Audience) verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid token that was issued for a different audience (e.g., another service) when multiple services share the same issuer/keys. This can lead to unintended cross-service access. Hono’s docs list verification options for iss/nbf/iat/exp only, with no aud support; RFC 7519 requires that when an aud claim is present, tokens MUST be rejected unless the processing party identifies itself in that claim. This issue has been patched in version 4.10.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-285"],"references":["https://github.com/honojs/hono/commit/45ba3bf9e3dff8e4bd85d6b47d4b71c8d6c66bef","https://github.com/honojs/hono/security/advisories/GHSA-m732-5p4w-x69g"],"products":["hono:hono"],"source":"nvd","synced_at":"2026-10-19T22:12:35.277909958+00:00"},"epss":{"cve":"CVE-2025-62610","score":0.00384,"percentile":0.32218,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-m732-5p4w-x69g","url":"https://osv.dev/vulnerability/GHSA-m732-5p4w-x69g","summary":"Hono Improper Authorization vulnerability","modified":"2026-09-10T03:50:30.075301408Z","packages":[{"ecosystem":"npm","name":"hono","purl":"pkg:npm/hono","ranges":[">=1.1.0 <4.10.2"],"fixed":["4.10.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}