Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning in github.com/centrifugal/centrifugo

概要

参考情報

• centrifugal/centrifugo security advisory · ADVISORY
• centrifugal/centrifugo commit dab80fe · FIX
• centrifugal/centrifugo release v6.7.0 · WEB

github.com/centrifugal/centrifugo のその他の脆弱性

• CVE-2026-71485緊急 9.1Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRe…
• CVE-2026-49998高 8.2Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse …
• GHSA-q926-c743-49qj低 0.0Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning
• CVE-2026-32301緊急 9.3Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (S…
• GO-2026-4528Centrifugo v6.6.0 dependency vulnerabilities in github.com/centrifugal/centrifugo