CVE-2026-71485

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in...

CVE-2026-71485 Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in...

EUVD-2026-63649

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in...

CVE-2026-71485

Centrifugo (open-source real-time messaging server) prior to 6.9.0 contains a header spoofing vulnerability in its proxy and transport layers. The client-controlled protocol.ConnectRequest.headers map is copied through OnClientConnecting, ConnectEvent.Headers, and SetEmulatedHeadersToContext, and...

CVE-2026-71485 Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in...

PT-2026-79145

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in...

SUSE CVE-2026-49998

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not...

CVE-2026-62963

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uniwebsocket.compression enabled enforced uniwebsocket.messagesizelimit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but...

CVE-2026-49998

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not...

CVE-2026-62963

CVE-2026-62963 affects Centrifugo prior to 6.8.4. The unidirectional WebSocket transport with uni_websocket.compression enabled did not cap output after decompression in ReadMessage (internal/websocket/conn.go advanceFrame), allowing unauthenticated requests to /connection/uni_websocket to trigge...

CVE-2026-62963 Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uniwebsocket.compression enabled enforced uniwebsocket.messagesizelimit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but...

CVE-2026-62963 Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uniwebsocket.compression enabled enforced uniwebsocket.messagesizelimit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but...

CVE-2026-49998 Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not...

CVE-2026-49998

CVE-2026-49998 describes a cross-issuer JWT authentication bypass in Centrifugo prior to v6.8.1 caused by the JWKS cache and singleflight lookup being keyed only by the JWT header kid. The JWKS URL is resolved later from tokenVars to a per-tenant endpoint, but caches (and TTL) and the in-flight f...

EUVD-2026-45015

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not...

CVE-2026-49998

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not...

CVE-2026-49998 Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JWT header kid, not...

GO-2026-5872 Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass in github.com/centrifugal/centrifugo

Centrifugo's dynamic JWKS key cache keyed only by kid allows cross-issuer JWT authentication bypass in github.com/centrifugal/centrifugo...

CVE-2026-49998

creationtimestamp| type| source ---|---|--- 2026-07-01 22:35:18+00:00| published-proof-of-concept| https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj 2026-07-16 23:28:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsf7jmkdr2m...

GHSA-G6VG-WJ8F-48CJ Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Summary Centrifugo's dynamic JWKS endpoint feature can verify a JWT for one allowed issuer using a public key cached from another allowed issuer. The JWKS cache and singleflight lookup are keyed only by the JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or other trust-domain...