Centrifugo is an open‑source real‑time messaging server that, prior to version 6.7.0, has a vulnerability allowing an unauthenticated attacker to trigger Server‑Side Request Forgery (SSRF). By injecting a malicious issuer (iss) or audience (aud) claim into a JWT, the attacker can cause the server to interpolate that claim into a dynamically configured JWKS endpoint URL before the token signature is verified. Consequently, Centrifugo will fetch the JWKS from an attacker‑controlled URL, resulting in arbitrary outbound HTTP requests from the server.

The vulnerability affects all Centrifugo installations from the vendor centrifugal that are running a version earlier than 6.7.0. Product identification is provided via the CPE string: cpe:2.3:a:centrifugal:centrifugo:*:*:*:*:*:*:*:*.

The flaw has a CVSS score of 9.3, categorized as critical. An EPSS score of less than 1% indicates low reported exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. Attack can be performed without authentication and requires only outbound network connectivity from the affected server to an attacker‑controlled destination. The combination of high impact and low exploitability suggests that the risk is significant but may be mitigated by timely patching.