Hono Framework EUVD-2026-32927

The Hono application must use the built-in jwt or jwk middleware to protect one or more routes - applications not using these specific middleware components are unaffected. The attacker must possess a cryptographically valid JWT token accepted by the application's configured secret or JWKS endpoint; the vulnerability does not enable token forgery or signature bypass. The bypass is triggered by submitting any Authorization header whose scheme is not 'Bearer' but whose second segment is a valid JWT (e.g., 'Basic eyJ...', 'Token eyJ...'). AC:H in the CVSS vector explicitly encodes the requirement for a pre-obtained valid token. Applications with additional downstream scheme validation or API gateways enforcing strict Bearer requirements would not be susceptible to the bypass even if running a vulnerable Hono version.

The CVSS 4.8 Medium score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N is internally consistent with the vulnerability's realistic constraints. The High Attack Complexity (AC:H) is the critical limiting factor: exploitation is not opportunistic - the attacker must already possess a valid JWT token signed with the application's secret or trusted key material, which significantly narrows the attacker population. The impact is partial (C:L/I:L), with no availability impact and no scope change. No EPSS score was provided in the input data, so probability-based prioritization cannot be performed. The vulnerability is not in CISA KEV, and no public exploit code has been identified, indicating no observed mass exploitation. In practice, this is a protocol correctness flaw that matters most in environments where downstream systems or audit controls distinguish authentication schemes, or where defense-in-depth depends on strict Bearer enforcement. For typical deployments, the absence of token-forging capability substantially limits impact compared to a full authentication bypass.

An attacker who holds a valid JWT token - for example, obtained from a prior authenticated session, a shared signing key environment, or a token issued by a related service - constructs an HTTP request to a Hono-protected endpoint with the Authorization header set to 'Basic <valid-JWT>' instead of 'Bearer <valid-JWT>'. The Hono jwt middleware, lacking scheme validation, extracts the token portion, verifies it cryptographically, finds it valid, and grants access. No public exploit code identified at time of analysis.