Executive brief
Hono is a web framework with built-in JWT authentication middleware. A flaw in how it verifies JWT tokens allows attackers to forge authentication tokens by manipulating the algorithm field, potentially bypassing login and authorization checks. Applications using Hono's JWT middleware for access control are at risk of unauthorized account access and privilege escalation.
Technical details
The vulnerability is a JWT algorithm confusion flaw (CWE-347) in Hono's JWK/JWKS verification middleware. When a JWK lacks an explicit alg field (common in real-world JWKS configurations), the middleware fell back to trusting the alg value from the unverified JWT header itself, allowing an attacker to control which algorithm was used for signature verification. This enables forged tokens to pass validation if the attacker can guess or influence the verification process. The issue affects all versions prior to 4.11.4; the fix requires applications to explicitly specify the alg parameter in their jwt() configuration, breaking backward compatibility. Network-reachable authentication endpoints with JWT-based access control are vulnerable with no user interaction required.
Affected products
- Hono Hono < 4.11.4
Timeline
- 2026-01-13: disclosed
- 2026-01-13: patched: Fixed in version 4.11.4