Junglewise Threat Intelligence
GO-2026-4703 - Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning in github.com/centrifugal/centrifugo
Severity: info · Published 2026-03-26
Technologies: github.com/centrifugal/centrifugo/v4 (Go), github.com/centrifugal/centrifugo/v3 (Go), github.com/centrifugal/centrifugo/v6 (Go), github.com/centrifugal/centrifugo (Go), github.com/centrifugal/centrifugo/v5 (Go). Vendors: Go.
Executive brief
Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning in github.com/centrifugal/centrifugo
Affected products
- Go github.com/centrifugal/centrifugo/v4
- Go github.com/centrifugal/centrifugo/v3
- Go github.com/centrifugal/centrifugo/v6
- Go github.com/centrifugal/centrifugo
- Go github.com/centrifugal/centrifugo/v5