Skip to content
Threat Feed
Subscribe

Product

Centrifugo V6

1 brief RSS
critical advisory

Centrifugo JWKS Cache Authentication Bypass

A critical authentication bypass vulnerability exists in Centrifugo v6's dynamic JWKS endpoint feature, allowing an attacker to bypass JWT authentication for one tenant by leveraging a valid token from another tenant due to incorrect JWKS key caching indexed only by the `kid`.

Centrifugo v6 authentication-bypass jwt jwks centrifugo web-application
2t