Junglewise Threat Intelligence
Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning
Severity: low · CVSS 3.1 · Published 2026-03-13
Technologies: github.com/centrifugal/centrifugo/v4 (Go), github.com/centrifugal/centrifugo/v3 (Go), github.com/centrifugal/centrifugo/v6 (Go), github.com/centrifugal/centrifugo (Go), github.com/centrifugal/centrifugo/v5 (Go). Vendors: Go.
Executive brief
Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning
Affected products
- Go github.com/centrifugal/centrifugo/v4
- Go github.com/centrifugal/centrifugo/v3
- Go github.com/centrifugal/centrifugo/v6
- Go github.com/centrifugal/centrifugo
- Go github.com/centrifugal/centrifugo/v5