CVE-2025-62610

    Dashboard / Vulnerabilities / CVE-2025-62610

    CVE-2025-62610

    Published: 22 Oct 2025Last Modified: 10 Oct 2026

    Summary: Hono Improperly Authorizes JWT Audience Validation

    Details: Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud (Audience) verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid token that was issued for a different audience (e.g., another service) when multiple services share the same issuer/keys. This can lead to unintended cross-service access. Hono’s docs list verification options for iss/nbf/iat/exp only, with no aud support; RFC 7519 requires that when an aud claim is present, tokens MUST be rejected unless the processing party identifies itself in that claim. This issue has been patched in version 4.10.2.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62610.json, https://github.com/honojs/hono/security/advisories/GHSA-m732-5p4w-x69g, https://nvd.nist.gov/vuln/detail/CVE-2025-62610, https://github.com/honojs/hono/commit/45ba3bf9e3dff8e4bd85d6b47d4b71c8d6c66bef

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 36f0a2801b0ee25ce7ad4305b945167672147d6f
    Fixed -0c6455dc10db6428257bdd601eca559247e27de6

    Affected versions

    v4.10.1
    v4.10.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2025-62610 | CVE-DB