AIKIDO-2026-615271
github.com/dunglas/mercure/caddy is vulnerable to Improper Verification of Cryptographic Signature
58
Medium Risk
This Affects:
github.com/dunglas/mercure/caddyTL;DR
The Caddy module signs tokens with static key material and uses it as an HMAC secret whenever it does not start with the literal "-----BEGIN" prefix. A PEM encoded public key preceded by an OpenSSL textual preamble does not start with that prefix, so the module uses those raw bytes as the HMAC secret instead of rejecting them, and anyone with the public key can forge tokens. The fix rejects key material that contains a PEM block anywhere, not only at the start, when the algorithm is HMAC.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
github.com/dunglas/mercure/caddy is vulnerable to Improper Verification of Cryptographic Signature in versions 0.0.1 - 1.0.0.
How to fix this
Upgrade the github.com/dunglas/mercure/caddy and/or github.com/dunglas/mercure library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.