Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning in github.com/centrifugal/centrifugo

Description

References

• centrifugal/centrifugo security advisory · ADVISORY
• centrifugal/centrifugo commit dab80fe · FIX
• centrifugal/centrifugo release v6.7.0 · WEB

More vulnerabilities in github.com/centrifugal/centrifugo

• CVE-2026-71485CRITICAL 9.1Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRe…
• CVE-2026-49998HIGH 8.2Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse …
• GHSA-q926-c743-49qjLOW 0.0Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning
• CVE-2026-32301CRITICAL 9.3Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (S…
• GO-2026-4528Centrifugo v6.6.0 dependency vulnerabilities in github.com/centrifugal/centrifugo