The flaw arises from the JWT utility in the Hono framework failing to validate the NumericDate claims – exp, nbf, and iat – during verification. When a token containing a non‑spec‑compliant timestamp reaches verify(), the checks silently succeed, which allows the token to be accepted even though its time claims are invalid. The description makes clear that an attacker who does not control either the token issuance or the signing key cannot use this flaw to forge a valid token, so the vulnerability is not directly exploitable from outside the application.

All installations of the honojs Hono web framework with a version older than 4.12.18, regardless of the JavaScript runtime used, inherit this issue. The vulnerability was fixed in the 4.12.18 release, after which proper validation of NumericDate claims was restored.

With a CVSS score of 3.8, the vulnerability is classified as low severity and is not listed in the CISA KEV catalog. The Exploit Prediction Scoring System does not have a score for this issue. Exploitation requires reuse of a token that contains a malformed timestamp or an attacker who controls the signing key used in verification, scenarios that are unlikely to arise outside of a compromised or misconfigured internal service. Consequently, the practical risk to organizations is limited to situations where the application generates insecure tokens or the signing key is compromised.