CVE-2026-47673 is an improper authorization vulnerability (CWE-285) in the honojs hono framework affecting versions before 4.12.21. The jwt and jwk middlewares fail to enforce that the Authorization header uses the Bearer scheme, allowing any two-part header value to be processed for JWT verification. Consequently, a valid JWT token presented with a non-Bearer scheme identifier (e.g., Basic or Token) is treated as authenticated. This flaw could lead to unintended authentication bypass scenarios. The vulnerability has a CVSS 3.1 base score of 4.8 (medium severity) and was fixed in version 4.12.21.

The vulnerability allows an attacker to authenticate using a valid JWT token even if the Authorization header does not use the Bearer scheme, potentially bypassing intended authorization checks. The impact is limited to confidentiality and integrity with no availability impact, and requires network access with high attack complexity and no privileges or user interaction. No known exploits are reported in the wild.

Upgrade the honojs hono framework to version 4.12.21 or later, where the jwt and jwk middlewares properly verify that the Authorization header uses the Bearer scheme. Patch status is confirmed by the vendor's fix in 4.12.21. Until upgraded, carefully validate Authorization headers in application code as a temporary mitigation.