github.com/centrifugal/centrifugo/v4

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 8.2

CVE-2026-49998

Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup …

centrifugal centrifugo github.com/centrifugal/centrifugo/v3 github.com/centrifugal/centrifugo/v6 Go

Jul 16, 2026