CVE-2026-49998 is an improper verification of cryptographic signature vulnerability (CWE-347) in Centrifugo before version 6.8.1. The dynamic JWKS endpoint verification reused keys for one allowed issuer to verify JWTs for another allowed issuer because the JWKS cache and singleflight lookup keyed only by the JWT header kid. This flaw affected components including client.token.jwks_public_endpoint, client.subscription_token.jwks_public_endpoint, internal/jwks/cache.go, and internal/jwks/manager.go. The vulnerability could allow an attacker to bypass issuer validation, potentially leading to privilege escalation or unauthorized access. The issue is resolved in Centrifugo version 6.8.1.

The vulnerability allows improper verification of JWT signatures by reusing keys across different allowed issuers, which can lead to compromise of authentication and authorization mechanisms. This can result in an attacker forging tokens that are accepted as valid for different issuers, causing a high impact on confidentiality and integrity. Availability is not affected.

Upgrade Centrifugo to version 6.8.1 or later, where this vulnerability is fixed. Patch status is confirmed by the vendor advisory stating the issue is resolved in 6.8.1. No other mitigation is indicated or required.