What is the CVSS score of CVE-2026-47673?

CVE-2026-47673 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-47673?

Yes, a patch is available for CVE-2026-47673. Update the affected software to the latest version immediately.

Hono Framework CVE-2026-47673

EUVD-2026-32927 MEDIUM

Improper Authorization (CWE-285)

2026-05-28 GitHub_M

GHSA-f577-qrjj-4474

Authentication Bypass Hono

4.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 28, 2026 - 18:02 EUVD

Analysis Generated

May 28, 2026 - 17:25 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 npm packages depend on hono (8 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.12.21.

DescriptionGitHub Advisory

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value - regardless of the scheme name in the first position - proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is fixed in 4.12.21.

AnalysisAI

Hono's jwt and jwk middleware components fail to enforce the Bearer scheme in the Authorization header, allowing any two-part header value - such as 'Basic <token>' or 'Token <token>' - to pass JWT verification identically to a correctly formed Bearer request. All Hono releases prior to 4.12.21 on any supported JavaScript runtime are affected when these middlewares protect routes. No public exploit identified at time of analysis, and this is not listed in CISA KEV; real-world exploitation requires the attacker to already possess a valid, properly signed JWT.

Technical ContextAI

Hono is a lightweight, cross-runtime Web application framework for JavaScript, supporting Cloudflare Workers, Deno, Bun, Node.js, and other runtimes. Its jwt and jwk built-in middlewares are designed to protect routes by parsing the Authorization header, extracting the token, and verifying it cryptographically. The defect is that the middleware extracts the second segment of any two-part header value without first validating that the first segment is specifically the string 'Bearer'. CWE-285 (Improper Authorization) describes this root cause class precisely: the authorization decision proceeds on an incomplete check, omitting a mandatory scheme validation step. The CPE string cpe:2.3:a:honojs:hono:*:*:*:*:*:*:*:* reflects that all versions of the honojs/hono package across all environments are affected prior to the patched release.

RemediationAI

The primary fix is to upgrade Hono to version 4.12.21 or later, which enforces strict Bearer scheme validation in the jwt and jwk middlewares before proceeding to token verification. This fix version is confirmed by the vendor security advisory at https://github.com/honojs/hono/security/advisories/GHSA-f577-qrjj-4474. For teams unable to upgrade immediately, a targeted compensating control is to prepend a custom middleware layer that explicitly rejects any Authorization header whose scheme segment is not the literal string 'Bearer', returning a 401 before the jwt/jwk middleware is reached. This has minimal side effects for well-formed clients but adds a validation gate that closes the scheme-bypass path. No other workarounds are referenced in the available advisory data.