Description
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace, affecting client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, and internal/jwks/manager.go. This issue is fixed in version 6.8.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| centrifugal | centrifugo | < 6.8.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/centrifugal/centrifugo | <= 2.4.0 | — | GHSA-g6vg-wj8f-48cj |
| Go | github.com/centrifugal/centrifugo | all versions | — | GO-2026-5872 |
| Go | github.com/centrifugal/centrifugo/v3 | <= 3.2.3 | — | GHSA-g6vg-wj8f-48cj |
| Go | github.com/centrifugal/centrifugo/v3 | all versions | — | GO-2026-5872 |
| Go | github.com/centrifugal/centrifugo/v4 | <= 4.1.5 | — | GHSA-g6vg-wj8f-48cj |
| Go | github.com/centrifugal/centrifugo/v4 | all versions | — | GO-2026-5872 |
| Go | github.com/centrifugal/centrifugo/v5 | <= 5.4.9 | — | GHSA-g6vg-wj8f-48cj |
| Go | github.com/centrifugal/centrifugo/v5 | all versions | — | GO-2026-5872 |
| Go | github.com/centrifugal/centrifugo/v6 | < 6.8.1 | 6.8.1 | GHSA-g6vg-wj8f-48cj |
Advisories 1
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026