Go/github.com/centrifugal/centrifugo

Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Modified: 9/28/2026

Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Modified: 7/7/2026

Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

Modified: 3/27/2026

Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning

Modified: 3/27/2026

Centrifugo v6.6.0 dependency vulnerabilities in github.com/centrifugal/centrifugo

Modified: 2/23/2026

Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL in github.com/centrifugal/centrifugo

Modified: 3/26/2026

Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning in github.com/centrifugal/centrifugo

Modified: 3/26/2026

Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass in github.com/centrifugal/centrifugo

Modified: 7/7/2026

Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends in github.com/centrifugal/centrifugo

Modified: 9/28/2026