Identity Theft on the Edge: Exploiting JWT Algorithm Confusion in Hono
Jan 14, 2026·6 min read·14 visits
Executive Summary (TL;DR)
Hono versions prior to 4.11.4 failed to enforce specific cryptographic algorithms in their JWT middleware. This classic 'Algorithm Confusion' flaw allows attackers to sign malicious tokens using the server's publicly available RSA public key, treating it as an HMAC secret. The result is a total authentication bypass. Update to 4.11.4 immediately and explicitly define your `alg` parameter.
A critical authentication bypass vulnerability in the Hono web framework allows attackers to forge JSON Web Tokens (JWTs) by confusing the verification algorithm. By swapping asymmetric algorithms (like RS256) for symmetric ones (HS256) in the token header, an attacker can trick the server into verifying the signature using its own public key as a shared secret.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:NAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
Hono HonoJS | < 4.11.4 | 4.11.4 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-347 |
| Attack Vector | Network |
| CVSS Score | 8.2 (High) |
| Confidentiality | Low (Access) |
| Integrity | High (Forgery) |
| Exploit Status | Poc Available |
MITRE ATT&CK Mapping
Improper Verification of Cryptographic Signature