Executive brief
Centrifugo is a real-time messaging server used to deliver instant updates to web and mobile applications. A security flaw in how the server verifies user identities in multi-tenant environments could allow an attacker who controls one tenant to impersonate users in a different tenant. This could lead to unauthorized access to private messages or the ability to send messages as another user, potentially compromising sensitive customer data and system integrity.
Technical details
A vulnerability exists in Centrifugo's dynamic JSON Web Key Set (JWKS) verification logic where the internal cache and singleflight lookups are keyed solely by the 'kid' (Key ID) header from the JWT. In multi-tenant configurations using templated JWKS endpoints, this allows a key fetched for one issuer to satisfy verification for another issuer if they share the same 'kid'. An attacker with the ability to provide a valid token for one tenant can impersonate users in another tenant if they can ensure their key is cached first. This affects configurations using 'client.token.jwks_public_endpoint' and 'client.subscription_token.jwks_public_endpoint'. The issue is resolved in version 6.8.1 by using a composite cache key consisting of the resolved endpoint URL and the 'kid'.
Affected products
- Centrifugal Centrifugo < 6.8.1
Timeline
- 2026-05-27: patched: Fixed in version 6.8.1
- 2026-07-16: advisory: CVE-2026-49998 published