CVE-2026-49998

{
  "id": "CVE-2026-49998",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-16T20:16:45.290",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace, affecting client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, and internal/jwks/manager.go. This issue is fixed in version 6.8.1."
    },
    {
      "lang": "es",
      "value": "Centrifugo es un servidor de mensajería en tiempo real escalable de código abierto. Antes de 6.8.1, la verificación dinámica de puntos finales JWKS de Centrifugo podría reutilizar una clave para un emisor permitido para verificar un JWT para otro emisor permitido porque la caché JWKS y la búsqueda singleflight se indexaban solo por el kid del encabezado JWT, no por el punto final JWKS resuelto, el emisor, la audiencia o el espacio de nombres del dominio de confianza, afectando a client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, e internal/jwks/manager.go. Este problema está solucionado en la versión 6.8.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "centrifugal",
          "product": "centrifugo",
          "versions": [
            {
              "version": "< 6.8.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-17T11:13:16.710942Z",
          "id": "CVE-2026-49998",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/centrifugal/centrifugo/commit/15d785015c6f318c1b68ea40b813699c9f8bd2c4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/centrifugal/centrifugo/pull/1142",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/centrifugal/centrifugo/releases/tag/v6.8.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}