CVE-2025-62610 (CNNVD-202510-2858)
中文标题:
Hono 授权问题漏洞
英文标题:
Hono Improperly Authorizes JWT Audience Validation
漏洞描述
中文描述:
Hono是Hono社区的一个用 TypeScript 编写的 Web 框架。 Hono 1.1.0版本至4.10.2之前版本存在授权问题漏洞，该漏洞源于JWT Auth Middleware缺少内置受众验证选项，可能导致令牌混淆和跨服务访问问题。
英文描述:
Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud (Audience) verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid token that was issued for a different audience (e.g., another service) when multiple services share the same issuer/keys. This can lead to unintended cross-service access. Hono’s docs list verification options for iss/nbf/iat/exp only, with no aud support; RFC 7519 requires that when an aud claim is present, tokens MUST be rejected unless the processing party identifies itself in that claim. This issue has been patched in version 4.10.2.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| honojs | hono | >= 1.1.0, < 4.10.2 | - | - |
cpe:2.3:a:honojs:hono:>=_1.1.0,_<_4.10.2:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-62610 |
2025-11-11 15:23:33 | 2025-11-11 07:40:49 |
| NVD | nvd_CVE-2025-62610 |
2025-11-11 15:01:06 | 2025-11-11 07:48:35 |
| CNNVD | cnnvd_CNNVD-202510-2858 |
2025-11-11 15:13:00 | 2025-11-11 08:00:18 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-202510-2858
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']