CVE-2026-22818

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4.

• CWE-347

• https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134Patch
• https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4Third Party Advisory

Published

Jan 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22812OpenCode is an open source AI coding agent. Prior to 1.0.216…8.8
• CVE-2026-22813OpenCode is an open source AI coding agent. The markdown ren…6.1
• CVE-2026-22814@adonisjs/lucid is an SQL ORM for AdonisJS built on top of K…8.2
• CVE-2026-22815AIOHTTP is an asynchronous HTTP client/server framework for …7.5
• CVE-2026-22816Gradle is a build automation tool, and its native-platform t…7.4
• CVE-2026-22817Hono is a Web application framework that provides support fo…6.5
• CVE-2026-22819Outray openSource ngrok alternative. Prior to 0.1.5, this vu…3.1
• CVE-2026-2282The Slidorion plugin for WordPress is vulnerable to Stored C…4.4
• CVE-2026-22820Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTO…3.7
• CVE-2026-22821mreporting is the more reporting GLPI plugin. Prior to 1.9.4…6.5
• CVE-2026-22822External Secrets Operator reads information from a third-par…8.8
• CVE-2026-22828A heap-based buffer overflow vulnerability in Fortinet Forti…8.1