High · published October 23, 2025
⚡ Hono’s JWT Auth Middleware is a ticket with no audience check, letting valid tokens slip into the wrong hands like a concert pass for an entirely different show! 🎟️ Think of it like a restaurant that serves multiple cuisines, but doesn't check if you have a reservation for Thai or Italian. You could end up dining at the wrong table, and worse, someone else could feast on your carefully ordered meal! This oversight can be absolutely devastating! An attacker could access services they shouldn’t, using tokens meant for another audience. Imagine someone wandering into a VIP area of an event just because they had the right-looking pass!
Think of it like a restaurant that serves multiple cuisines, but doesn't check if you have a reservation for Thai or Italian. You could end up dining at the wrong table, and worse, someone else could feast on your carefully ordered meal! In Hono versions 1.1.0 to before 4.10.2, the JWT Auth Middleware lacks an audience ('aud') claim verification, which means it accepts valid tokens from any service sharing the same issuer/keys, ignoring that tokens should be specific to intended recipients.
This oversight can be absolutely devastating! An attacker could access services they shouldn’t, using tokens meant for another audience. Imagine someone wandering into a VIP area of an event just because they had the right-looking pass! Update Hono to version 4.10.2 right away to add the crucial 'aud' verification. It’s also wise to audit your token usage and ensure no unintended access is granted across services that share keys. You’ve got this! Patch up and secure your services, and you'll be a security hero in no time! 🦸♂️
| Product | Versions | Fixed in |
|---|---|---|
| hono/hono | ≥ 1.1.0, < 4.10.2 | 4.10.2 |