CVE-2026-22818:

JWT algorithm confusion vulnerability in Hono's JWK/JWKS verification middleware prior to version 4.11.4.

Score
A numerical rating that indicates how dangerous this vulnerability is.

6.5Medium

Published Date:Jan 13, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.0
EPSS Percentile:4%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:2.5
Confidentiality Impact:LOW
Integrity Impact:LOW
Availability Impact:NONE

Description Preview

JWT algorithm confusion vulnerability in Hono's JWK/JWKS verification middleware prior to version 4.11.4.

Overview

The vulnerability (CVE-2026-22818) affects Hono versions prior to 4.11.4. It stems from a design flaw in the JWK/JWKS JWT verification middleware, where the algorithm specified in the JWT header could influence the signature verification process when the selected JWK did not explicitly define an algorithm. This weakness could enable attackers to exploit JWT algorithm confusion techniques, potentially leading to the acceptance of forged tokens in specific configurations. The vulnerability has a CVSS v3.1 base score of 8.2 (High), indicating significant potential impact, particularly on integrity and confidentiality. The attack vector is network-based, requires no privileges or user interaction, and has a low attack complexity, making it relatively easy to exploit.

Remediation

To address this vulnerability, users should upgrade to Hono version 4.11.4 or later. The fix involves updating the JWK/JWKS JWT verification middleware to require an explicit allowlist of asymmetric algorithms when verifying tokens. This change prevents the middleware from deriving the verification algorithm from untrusted JWT header values, effectively mitigating the risk of algorithm confusion attacks. Organizations using Hono should prioritize this update, especially if they rely on JWT-based authentication in their applications.