{"answers":{"affected":"15 open source packages ship an affected version, including github.com/centrifugal/centrifugo, github.com/centrifugal/centrifugo/v3 and github.com/centrifugal/centrifugo/v4.","exploited":"There is no known exploitation of GHSA-q926-c743-49qj in the wild and no public exploit code.","fix":"Change a configuration setting.","what":"GHSA-q926-c743-49qj is an authentication bypass vulnerability in github.com/centrifugal/centrifugo, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-q926-c743-49qj and fix it if it is affected.\n\nWhat it is: GHSA-q926-c743-49qj is an authentication bypass vulnerability in github.com/centrifugal/centrifugo, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-q926-c743-49qj in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/centrifugal/centrifugo (Go): affected all versions; no fix listed\n- github.com/centrifugal/centrifugo (Go): affected all versions up to 2.4.0; no fix listed\n- github.com/centrifugal/centrifugo (Go): affected all versions up to 2.4.0; no fix listed\n- github.com/centrifugal/centrifugo/v3 (Go): affected all versions; no fix listed\n- github.com/centrifugal/centrifugo/v3 (Go): affected all versions up to 3.2.3; no fix listed\n- github.com/centrifugal/centrifugo/v3 (Go): affected all versions up to 3.2.3; no fix listed\n- github.com/centrifugal/centrifugo/v4 (Go): affected all versions; no fix listed\n- github.com/centrifugal/centrifugo/v4 (Go): affected all versions up to 4.1.5; no fix listed\n- github.com/centrifugal/centrifugo/v4 (Go): affected all versions up to 4.1.5; no fix listed\n- github.com/centrifugal/centrifugo/v5 (Go): affected all versions; no fix listed\n- github.com/centrifugal/centrifugo/v5 (Go): affected all versions up to 5.4.9; no fix listed\n- github.com/centrifugal/centrifugo/v5 (Go): affected all versions up to 5.4.9; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-q926-c743-49qj/ (Markdown: https://insights.sbomify.com/GHSA-q926-c743-49qj/index.md)","id":"GHSA-q926-c743-49qj","markdown":"https://insights.sbomify.com/GHSA-q926-c743-49qj/index.md","name":"GHSA-q926-c743-49qj","record":{"aliases":["GO-2026-4703"],"analysis":{"component_type":"server_software","fix_type":"configuration_change","impacts":["security_bypass","account_takeover"],"network_reachable":"yes","non_default_config":true,"product_category":"Real-time messaging server","requires_auth":"none","summary":"Centrifugo allows JWT signature verification bypass if a specific insecure flag is enabled, leading to unauthorized access without operator warnings.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nCentrifugo supports a configuration flag `insecure_skip_token_signature_verify` that completely disables JWT signature verification. When enabled, Centrifugo accepts any JWT token regardless of signature validity — including tokens signed with wrong keys, random signatures, or no signature at all. Critically, no warning is logged at startup or runtime when this flag is active, making it invisible to operators and security auditors.\n\nNote: This vulnerability requires the operator to have explicitly set insecure_skip_token_signature_verify=true. The core issue is the absence of any warning when this flag is active, making accidental production exposure undetectable.\n\n### Details\nThe flag is defined in `internal/configtypes/types.go`:\n```\nInsecureSkipTokenSignatureVerify bool `mapstructure:\"insecure_skip_token_signature_verify\"`\n```\n\nIt is passed directly to token verification in `internal/client/handler.go`:\n```\ntoken, err := h.tokenVerifier.VerifyConnectToken(e.Token, \n    cfg.Client.InsecureSkipTokenSignatureVerify)\n```\n\nIn `token_verifier_jwt.go`, when `skipVerify=true` the entire signature block is bypassed:\n```go\nif !skipVerify {\n    // This block never executes\n    err = verifier.verifySignature(token)\n}\n```\nThe flag is configurable via multiple vectors making accidental exposure likely:\n- Config file: `insecure_skip_token_signature_verify: true`\n- Environment variable: `CENTRIFUGO_INSECURE_SKIP_TOKEN_SIGNATURE_VERIFY=true`\n- YAML, TOML config formats\n\nDespite `hmac_secret_key` being configured, startup logs show `\"enabled JWT verifiers\"` — falsely implying verification is active.\n\n### PoC\nConfig with legitimate HMAC key but skip flag enabled:\n```json\n{\n  \"client\": {\n    \"insecure_skip_token_signature_verify\": true,\n    \"token\": { \"hmac_secret_key\": \"legitimate-production-secret-key\" }\n  }\n}\n```\n\nToken signed with completely wrong key is fully accepted:\n```\nVULNERABILITY CONFIRMED!\nConnected as user: {'client': '899dec73...', 'version': '0.0.0 OSS'}\n```\n\nNo security warning emitted when insecure_skip_token_signature_verify=true:\n![1](https://github.com/user-attachments/assets/606acae0-e6f7-467f-b512-b5350ec6cf38)\n\nToken signed with wrong key accepted, authentication bypass confirmed:\n![2](https://github.com/user-attachments/assets/a400c0bf-b78c-40cf-8c73-07fdabb0c672)\n\nskipVerify flag propagated from config to all token verification calls:\n![3](https://github.com/user-attachments/assets/4141eb05-0371-46e1-acb7-8a9091c45693)\n\n### Impact\n- Any unauthenticated user can connect as any arbitrary user ID\n- Complete authentication bypass — attacker sets any `sub` claim value\n- No indicators in logs that the server is operating insecurely\n- Easily triggered accidentally via environment variable injection\n  in containerized deployments (e.g. misconfigured Kubernetes secrets)\n- Affects all connection types: WebSocket, HTTP-streaming, SSE, GRPC\n \n### Suggested Fix\n1. Emit a loud startup warning when flag is enabled:\n```go\nif cfg.Client.InsecureSkipTokenSignatureVerify {\n    log.Warn().Msg(\"SECURITY WARNING: JWT signature verification is \" +\n        \"DISABLED via insecure_skip_token_signature_verify - \" + \n        \"DO NOT use in production!\")\n}\n```\n2. Consider requiring an additional explicit `insecure_mode: true` flag to prevent accidental single-flag misconfiguration\n3. Log a warning on every accepted token when skip is active","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning","id":"GHSA-q926-c743-49qj","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":15,"n_references":null,"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/centrifugal/centrifugo","purl":"pkg:golang/github.com/centrifugal/centrifugo","source":"GO-2026-4703"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["2.4.0"],"package":"github.com/centrifugal/centrifugo","purl":null,"source":"GHSA-q926-c743-49qj"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["2.4.0"],"package":"github.com/centrifugal/centrifugo","purl":"pkg:golang/github.com/centrifugal/centrifugo","source":"GHSA-q926-c743-49qj"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/centrifugal/centrifugo/v3","purl":"pkg:golang/github.com/centrifugal/centrifugo/v3","source":"GO-2026-4703"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["3.2.3"],"package":"github.com/centrifugal/centrifugo/v3","purl":null,"source":"GHSA-q926-c743-49qj"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["3.2.3"],"package":"github.com/centrifugal/centrifugo/v3","purl":"pkg:golang/github.com/centrifugal/centrifugo/v3","source":"GHSA-q926-c743-49qj"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/centrifugal/centrifugo/v4","purl":"pkg:golang/github.com/centrifugal/centrifugo/v4","source":"GO-2026-4703"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["4.1.5"],"package":"github.com/centrifugal/centrifugo/v4","purl":null,"source":"GHSA-q926-c743-49qj"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["4.1.5"],"package":"github.com/centrifugal/centrifugo/v4","purl":"pkg:golang/github.com/centrifugal/centrifugo/v4","source":"GHSA-q926-c743-49qj"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/centrifugal/centrifugo/v5","purl":"pkg:golang/github.com/centrifugal/centrifugo/v5","source":"GO-2026-4703"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["5.4.9"],"package":"github.com/centrifugal/centrifugo/v5","purl":null,"source":"GHSA-q926-c743-49qj"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["5.4.9"],"package":"github.com/centrifugal/centrifugo/v5","purl":"pkg:golang/github.com/centrifugal/centrifugo/v5","source":"GHSA-q926-c743-49qj"},{"ecosystem":"Go","fixed":["6.7.0"],"introduced":["0"],"last_affected":[],"package":"github.com/centrifugal/centrifugo/v6","purl":null,"source":"GHSA-q926-c743-49qj"},{"ecosystem":"Go","fixed":["6.7.0"],"introduced":["0"],"last_affected":[],"package":"github.com/centrifugal/centrifugo/v6","purl":"pkg:golang/github.com/centrifugal/centrifugo/v6","source":"GHSA-q926-c743-49qj"},{"ecosystem":"Go","fixed":["6.7.0"],"introduced":["0"],"last_affected":[],"package":"github.com/centrifugal/centrifugo/v6","purl":"pkg:golang/github.com/centrifugal/centrifugo/v6","source":"GO-2026-4703"}],"products":null,"published":"2026-03-13","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Centrifugo allows JWT signature verification bypass if a specific insecure flag is enabled, leading to unauthorized access without operator warnings.","url":"https://insights.sbomify.com/GHSA-q926-c743-49qj/"}