centrifugal/centrifugo Security Advisories | GitStock

critical2026-09-02

Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

GHSA-9468-v6mj-fppw · CVE-2026-71485

high2026-07-01

Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

GHSA-g6vg-wj8f-48cj · CVE-2026-49998

low2026-03-13

Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning

GHSA-q926-c743-49qj

critical2026-03-13

Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

GHSA-j77h-rr39-c552 · CVE-2026-32301

medium2026-02-19

Centrifugo v6.6.0 dependency vulnerabilities

GHSA-j9wf-6r2x-hqmx