The vulnerability lies in Hono’s JWT verification middleware, which previously allowed the ‘alg’ value in a token’s header to dictate the algorithm used when the selected JSON Web Key did not declare an explicitly supported algorithm. This behavior enables attackers to forge a JSON Web Token that will be accepted as valid, effectively allowing them to bypass authentication controls that rely on correctly signed tokens. The flaw maps to CWE‑347, representing an algorithmic confusion that lets untrusted header values influence signature validation.

The issue affects installations of the Hono framework, specifically versions earlier than 4.11.4. Developers using Hono for serverless or Node.js applications that employ the provided JWT middleware without explicitly specifying the algorithm in the options are vulnerable. The CVE identifiers point to all variants of Hono, including the generic Node.js distribution referenced by the CPE.

The item has a CVSS score of 8.2, indicating high impact. Attack complexity is likely low for an application that serves untrusted users, but the EPSS score is below 1 %, suggesting a rare exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit it by crafting a token with a mismatched or absent algorithm field when the server’s verification logic accepts it unconditionally, thereby forging a token that grants unauthorized access. Prompt remediation is advised.