The honojs hono web application framework before version 4.12.21 contains an improper authorization vulnerability (CWE-285) in its jwt and jwk middlewares. These middlewares fail to verify that the Authorization header uses the Bearer scheme, allowing any two-part header value to be accepted for JWT verification. Consequently, a valid JWT token presented with a non-Bearer scheme identifier is treated as authenticated, potentially bypassing intended scheme checks. This vulnerability has a CVSS 3.1 base score of 4.8 (medium severity) and was published on 2026-05-28. The issue is resolved in version 4.12.21.

An attacker who can present a valid JWT token with a non-Bearer scheme in the Authorization header can be authenticated identically to a legitimate Bearer token request. This improper authorization could lead to unauthorized access where scheme validation is expected. The impact is limited to confidentiality and integrity with no availability impact, and the attack complexity is high with no privileges or user interaction required.

Upgrade honojs hono to version 4.12.21 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 4.12.21, applying this official update is the recommended remediation. Patch status is confirmed by the vendor advisory. No additional mitigations are indicated.