CVE-2026-54287: Hono Jwt Jwk Alg Confusioncve-2026-54287-hono-jwt-jwk-alg-confusion
The JWT signing function creates a token header using a provided or default algorithm parameter without verifying if the provided key object contains its own native 'alg' or 'kid' properties. When a JSON Web Key (JWK) is passed natively to this signing function, it may be used with a mismatched symmetric algorithm (e.g., 'HS256'), leading to severe algorithm
