CVE-2026-49998

HighCVSS 8.2/10Last modified Oct 24, 2026

Description

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace, affecting client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, and internal/jwks/manager.go. This issue is fixed in version 6.8.1.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published: Jul 16, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-50007.3A vulnerability was detected in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. Impacted is the function LocalGPTHand CVE-2026-500039.8A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output dire CVE-2026-500057.7Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access camera feeds.CVE-2026-500069.1Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatib CVE-2026-500077.2Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access CVE-2026-500086.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version CVE-2026-500094.8Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes CVE-2026-50017.3A flaw has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The affected element is the function do_POST CVE-2026-500107.5Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, CVE-2026-500117.5Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, CVE-2026-500125.5Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapIn CVE-2026-500137.5Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function wri