Hono-r Among Thieves: Weaponizing JWT Algorithm Confusion in Hono Framework
Jan 14, 2026·5 min read·5 visits
Executive Summary (TL;DR)
Hono versions prior to 4.11.4 trust the JWT header's algorithm claim when the server's JWK Set lacks an explicit algorithm definition. An attacker can sign a malicious token using the server's public key as a symmetric HMAC secret (HS256), tricking the server into verifying the signature successfully and granting full access.
A critical authentication bypass in the Hono Web Framework allows attackers to exploit JWT algorithm confusion. By forcing the server to treat a public RSA key as a shared HMAC secret, attackers can forge valid tokens and gain administrative access.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:NAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
hono HonoJS | < 4.11.4 | 4.11.4 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-347 |
| Attack Vector | Network (Remote) |
| CVSS | 8.2 (High) |
| Impact | Authentication Bypass / Privilege Escalation |
| Exploit Status | POC Available |
| Affected Component | hono/jwk Middleware |
MITRE ATT&CK Mapping
The product does not verify or incorrectly verifies the cryptographic signature of data, allowing an attacker to modify data without detection.