CVE-2026-22818

High

Published: 13 January 2026

Published

13 January 2026

Modified

20 January 2026

KEV Added

—

Patch

—

CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

EPSS Score 0.0002 4.5th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22818 is a high-severity Improper Verification of Cryptographic Signature (CWE-347) vulnerability in Hono Hono. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the CVE by requiring identification, reporting, testing, and installation of software updates to remediate the Hono JWT algorithm confusion flaw prior to version 4.11.4.

SC-13 Cryptographic Protection good match

prevent

Ensures implementation of cryptographic mechanisms for signature verification that prevent reliance on untrusted JWT header algorithms, directly addressing the improper cryptographic signature verification.

SI-7 Software, Firmware, and Information Integrity good match

prevent

Mandates verification of information integrity using cryptographic signatures or hashes, countering the JWT algorithm confusion that allows forged tokens when JWK lacks explicit algorithm definition.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1606 Forge Web Credentials Credential Access

Adversaries may forge credential materials that can be used to gain access to web applications or Internet services.

attack.mitre.org →

Why these techniques?

Vulnerability in public-facing JWT verification middleware directly enables remote exploitation (T1190) and forging of accepted web credentials/tokens (T1606).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the…

selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an explicit allowlist of asymmetric algorithms when verifying tokens. The middleware no longer derives the verification algorithm from untrusted JWT header values. This vulnerability is fixed in 4.11.4.

Deeper analysisAI

CVE-2026-22818 is a vulnerability in Hono, a web application framework supporting any JavaScript runtime, affecting versions prior to 4.11.4. The flaw exists in Hono's JWK/JWKS JWT verification middleware, where the algorithm specified in the JWT header could influence signature verification if the selected JWK did not explicitly define an algorithm. This enables JWT algorithm confusion, potentially allowing forged tokens to be accepted in certain configurations. The issue is rated with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) and is associated with CWE-347 (Improper Verification of Cryptographic Signature).

Attackers can exploit this vulnerability remotely over the network with low complexity, requiring no privileges, user interaction, or special conditions. In affected setups, an unauthenticated adversary could craft a malicious JWT token that manipulates the verification process, leading to acceptance of forged tokens. This results in high integrity impact, such as unauthorized access or privilege escalation depending on the application's token usage, alongside low confidentiality impact.

The vulnerability is fixed in Hono version 4.11.4, where the JWK/JWKS JWT verification middleware now requires an explicit allowlist of asymmetric algorithms for token verification and no longer derives the algorithm from untrusted JWT header values. Security practitioners should upgrade to 4.11.4 or later. Additional details are available in the Hono GitHub security advisory (GHSA-3vhc-576x-3qv4) and the fixing commit (190f6e28e2ca85ce3d1f2f54db1310f5f3eab134).