JWT Algorithm Confusion in Hono Web Framework by Hono

CVE-2026-22818

What is CVE-2026-22818?

The Hono Web Application Framework contained a vulnerability in its JWK/JWKS JWT verification middleware prior to version 4.11.4. This flaw allowed the algorithm specified in the JWT header to improperly influence signature verification, particularly when the selected JWK did not explicitly define an algorithm. This scenario resulted in potential JWT algorithm confusion, which could enable the acceptance of forged tokens under certain configurations. The vulnerability has been addressed in version 4.11.4, which now mandates an explicit allowlist of asymmetric algorithms for token verification, eliminating reliance on untrusted JWT header values.

References