The flaw in the Hono framework’s JWK/JWKS JWT verification middleware permits the algorithm declared in the JWT header to dictate the signature verification process when the chosen JSON Web Key does not explicitly define an algorithm. This misconfiguration enables an attacker to craft a token that specifies a weaker or undesired algorithm and have it accepted by the middleware, effectively allowing the creation of forged tokens that may be treated as legitimate credentials.

The vulnerability affects applications built with the Hono JavaScript web framework prior to version 4.11.4. Any deployment that relies on the default JWT verification middleware without explicit configuration of an allowed algorithm list is susceptible. No specific operating system or runtime environment is required beyond those that host Hono with a compatible JavaScript runtime.

The vulnerability receives a CVSS score of 8.2, indicating a high impact on confidentiality and authentication. The EPSS score is under 1%, suggesting that while a possible exploitation exists, real-world leverage is currently limited. The issue is not listed in the CISA KEV catalog. Attackers would need to send a crafted JWT containing a manipulated algorithm field to a vulnerable application’s protected route; if the middleware falls back to using header.alg without validation, the token would be accepted and grant access. No special dependencies or unprivileged access are required beyond reaching the authentication endpoint.