The jwt and jwk middlewares in the Hono framework do not validate that the Authorization header carries a Bearer scheme. As a result, a request containing a valid JWT token under any other scheme name (e.g., Basic or Token) is treated the same as a proper Bearer request. This flaw allows an attacker to authenticate without adhering to the intended scheme, giving them unauthorized access to protected resources. The weakness is a classic authentication bypass (CWE‑285).

The vulnerability affects the Hono framework from the honojs vendor. All releases prior to version 4.12.21 are impacted; versions 4.12.21 and later contain the fix.

With a CVSS score of 4.8 the flaw is considered moderate in severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is straightforward: an attacker sends an HTTP request with an Authorization header that uses a non‑Bearer scheme but carries a valid JWT token. If the application relies on Hono’s jwt/jwk middleware, the request will be accepted, granting the attacker access. The lack of scheme enforcement represents a non‑fatal yet exploitable weakness that can be leveraged by attackers able to craft malicious HTTP requests.