5 results · Feed
-
Critical 9.1
Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeader…
-
High 8.2
Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup …
-
None 0.0
Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning
### Summary Centrifugo supports a configuration flag `insecure_skip_token_signature_verify` that completely disables JWT signature verification. When enabled, Centrifugo accepts any JWT token regardless of signature validity — including tokens signed with wro…
-
Critical 9.3
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated at…
-
Medium —
Centrifugo v6.6.0 dependency vulnerabilities
### Summary Centrifugo v6.6.0 binary is compiled with **Go 1.25.5** and statically links `github.com/quic-go/webtransport-go v0.9.0`, having **7 known CVEs** **Go standard library — compiled with Go 1.25.5:** | CVE | Severity | CVSS | Fixed In | |-----|------…