Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning
Date: 2026-03
Affected: go/github.com/centrifugal/centrifugo/v5, go/github.com/centrifugal/centrifugo/v4, go/github.com/centrifugal/centrifugo/v3
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Low
CWE: CWE-285
CVSS:  (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N)

### Summary Centrifugo supports a configuration flag `insecure_skip_token_signature_verify` that completely disables JWT signature verification. When enabled, Centrifugo accepts any JWT token regardless of signature validity — including tokens signed with wrong keys, random signatures, or no signature at all. Critically, no warning is logged at startup or runtime when this flag is active, making it invisible to operators and security auditors. Note: This vulnerability requires the operator to have explicitly set insecure_skip_token_signature_verify=true. The core issue is the absence of any warning when this flag is active, making accidental production exposure undetectable. ### Details The flag is defined in `internal/configtypes/types.go`: ``` InsecureSkipTokenSignatureVerify bool `mapstructure:"insecure_skip_token_signature_verify"` ``` It is passed directly to token verification in `internal/client/handler.go`: ``` token, err := h.tokenVerifier.VerifyConnectToken(e.Token, cfg.Client.InsecureSkipTokenSignatureVerify) ``` In `token_verifier_jwt.go`, when `skipVerify=true` the entire signature block is bypassed: ```go if !skipVerify { // This block never executes err = verifier.verifySignature(token) } ``` The flag is configurable via multiple vectors making accidental exposure likely: - Config file: `insecure_skip_token_signature_verify: true` - Environment variable: `CENTRIFUGO_INSECURE_SKIP_TOKEN_SIGNATURE_VERIFY=true` - YAML, TOML config formats Despite


Mitigations:

Architectural layers (MAESTRO):