Threat Intelligence Database

CVE-2026-71485 is an authentication bypass vulnerability in centrifugal centrifugo before version 6.9.0. It arises because client-supplied headers in the connect request are forwarded to backend services without proper validation, allowing attackers to spoof trusted headers used for authentication and authorization. This can lead to full impersonation of any identity the backend trusts based on these headers. The issue affects all proxy call types and persists for the lifetime of the connection.

Centrifugo versions prior to 6.8.1 contain a vulnerability in the dynamic JWKS endpoint verification process. The issue arises because the JWKS cache and singleflight lookup use only the JWT header 'kid' as a key, ignoring other important factors such as the resolved JWKS endpoint, issuer, audience, or trust-domain namespace. This flaw allows a key intended for one allowed issuer to be reused to verify a JWT from a different allowed issuer. The vulnerability is fixed in version 6.8.1.

CVE-2026-32301 is a critical Server-Side Request Forgery (SSRF) vulnerability in Centrifugo versions prior to 6.7.0. It arises when Centrifugo is configured with a dynamic JWKS endpoint URL that uses template variables such as {{tenant}}. An unauthenticated attacker can craft a malicious JWT with manipulated iss or aud claims, which are interpolated into the JWKS fetch URL before signature verification. This causes Centrifugo to make outbound HTTP requests to attacker-controlled destinations, potentially exposing internal network resources or enabling further attacks. The vulnerability has a CVSS score of 9.3, indicating high severity with critical impact on confidentiality. No known exploits are currently reported in the wild. The issue is fixed in version 6.

CriticalVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-32301#cwe-918