CVE-2026-49998

8.2 highEPSS 0.2%

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace, affecting client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, and internal/jwks/manager.go. This issue is fixed in version 6.8.1.

CVSS 3.1: 8.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-25)
CWE: CWE-347
Published: 2026-07-16
Modified: 2026-10-24
Record from: the NVD, synced 2026-10-25

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-g6vg-wj8f-48cj	Go	github.com/centrifugal/centrifugo/v6	<6.8.1	6.8.1
GHSA-g6vg-wj8f-48cj	Go	github.com/centrifugal/centrifugo/v5	<=5.4.9	no fix published
GHSA-g6vg-wj8f-48cj	Go	github.com/centrifugal/centrifugo/v4	<=4.1.5	no fix published
GHSA-g6vg-wj8f-48cj	Go	github.com/centrifugal/centrifugo/v3	<=3.2.3	no fix published
GHSA-g6vg-wj8f-48cj	Go	github.com/centrifugal/centrifugo	<=2.4.0	no fix published
GO-2026-5872	Go	github.com/centrifugal/centrifugo	all versions	no fix published
GO-2026-5872	Go	github.com/centrifugal/centrifugo/v3	all versions	no fix published
GO-2026-5872	Go	github.com/centrifugal/centrifugo/v4	all versions	no fix published
GO-2026-5872	Go	github.com/centrifugal/centrifugo/v5	all versions	no fix published
GO-2026-5872	Go	github.com/centrifugal/centrifugo/v6	<6.8.1	6.8.1

References

Check your stack JSON