Auth bypass in Hono
CVE-2025-62610
Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud (Audience) verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid token that was issued for a different audience (e.g., another service) when multiple services share the same issuer/keys. This can lead to unintended cross-service access. Hono’s docs list verification options for iss/nbf/iat/exp only, with no aud support; RFC 7519 requires that when an aud claim is present, tokens MUST be rejected unless the processing party identifies itself in that claim. This issue has been patched in version 4.10.2.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (30.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 30.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Hono
- Honojs Hono — versions >= 1.1.0, < 4.10.2
Weakness classification (CWE)
References
- github.com/honojs/hono/security/advisories/GHSA-m732-5p4w-x69g (Exploit, Mitigation, Vendor Advisory)
- github.com/honojs/hono/commit/45ba3bf9e3dff8e4bd85d6b47d4b71c8d6c66bef (Patch)
Frequently asked questions
- What is CVE-2025-62610?
- CVE-2025-62610 is a high-severity vulnerability in Hono, classified under Improper Authorization. CVSS score: 8.1/10. Published 2025-10-22.
- How severe is CVE-2025-62610?
- High severity. CVSS v3 base score is 8.1 out of 10.