Dynamic Key Reuse Vulnerability in Centrifugo Real-Time Messaging Server

CVE-2026-49998

What is CVE-2026-49998?

Centrifugo, an open-source scalable real-time messaging server, has a vulnerability that allows dynamic JWKS endpoint verification to misuse a key across different issuers. This issue arises because the JWKS cache and singleflight lookup utilize the JWT header 'kid' without appropriately differentiating between the resolved JWKS endpoint, issuer, audience, or trust-domain namespace. As a result, a key intended for one allowed issuer could mistakenly validate a JWT from another allowed issuer. This vulnerability affects key components, including client.token.jwks_public_endpoint and client.subscription_token.jwks_public_endpoint and has been addressed in version 6.8.1.

References