CVE-2025-62610
📋 TL;DR
Hono's JWT Auth Middleware lacks built-in audience (aud) claim verification, allowing valid tokens issued for different services to be accepted when multiple services share the same issuer/keys. This confused-deputy vulnerability enables unintended cross-service access. Affects Hono versions 1.1.0 through 4.10.1.
💻 Affected Systems
- Hono
⚠️ Risk & Real-World Impact
Worst Case
Attackers could use tokens from one service to gain unauthorized access to another service sharing the same issuer, potentially leading to data breaches, privilege escalation, or service compromise.
Likely Case
Accidental or intentional token reuse across services in multi-service architectures, causing authorization bypass and unintended data access.
If Mitigated
Proper audience verification prevents token reuse, limiting access to intended services only.
🎯 Exploit Status
Exploitation requires obtaining a valid JWT token from another service sharing the same issuer/keys.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.10.2
Vendor Advisory: https://github.com/honojs/hono/security/advisories/GHSA-m732-5p4w-x69g
Restart Required: Yes
Instructions:
1. Update Hono package to version 4.10.2 or later. 2. Restart the application. 3. Configure audience verification in JWT middleware if using aud claims.
🔧 Temporary Workarounds
Manual Audience Verification
allImplement custom middleware to verify aud claim matches expected service identifier.
// Example: Add custom JWT verification middleware
app.use('/api/*', async (c, next) => {
const token = c.req.header('Authorization')?.split(' ')[1];
if (token) {
const payload = jwt.verify(token, secret);
if (payload.aud && payload.aud !== 'expected-audience') {
return c.text('Invalid audience', 401);
}
}
await next();
});
🧯 If You Can't Patch
- Implement network segmentation to isolate services sharing JWT issuer/keys.
- Use different JWT signing keys for each service to prevent token reuse.
🔍 How to Verify
Check if Vulnerable:
Check package.json for Hono version between 1.1.0 and 4.10.1 and verify JWT middleware configuration lacks aud verification.Check Version:
npm list honoVerify Fix Applied:
Confirm Hono version is 4.10.2 or later and test JWT tokens with mismatched aud claims are rejected.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts with valid tokens from unexpected services
- JWT verification logs showing missing aud validation
Network Indicators:
- Unusual cross-service API calls using shared JWT tokens
SIEM Query:
source="application.log" AND ("JWT" AND "audience" AND "invalid")