CVE-2026-49998 is an improper verification of cryptographic signature vulnerability (CWE-347) in Centrifugo, an open-source real-time messaging server. Before version 6.8.1, the dynamic JWKS endpoint verification mechanism keyed its JWKS cache and singleflight lookup solely by the JWT header 'kid'. This insufficient keying allows reuse of a cryptographic key across different allowed issuers, potentially enabling an attacker to forge or misuse JWTs by exploiting the shared key cache. The affected components include client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, and internal JWKS cache and manager modules. The issue is resolved in Centrifugo 6.8.1.

This vulnerability can lead to a high-impact compromise of JWT validation, allowing an attacker to bypass issuer verification and potentially impersonate other allowed issuers. This breaks the trust model of JWT authentication, resulting in confidentiality and integrity violations of the authentication tokens. The CVSS score of 8.2 reflects a high severity with network attack vector, high complexity, low privileges required, no user interaction, and complete confidentiality and integrity impact.

Upgrade Centrifugo to version 6.8.1 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary workarounds. Patch status is confirmed by the vendor stating the fix is included in version 6.8.1.