CVE-2026-54286: Hono Jwt Sign Alg Not From Keycve-2026-54286-hono-jwt-sign-alg-not-from-key
The JWT `sign` function generates a token header using a separate algorithm parameter rather than extracting the algorithm and Key ID directly from the private key object. This omission leaves the framework vulnerable to algorithm confusion during verification because the algorithm and key are not cryptographically bound together.
