Verification Bypass in jsonwebtoken

CRITICO 9.8CVE-2015-9235 · GHSA-c7hr-j4mj-j2w6 · Published 29/05/2018 · updated 17/06/2026

In breve

CVE-2015-9235 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda jsonwebtoken (auth0), jsonwebtoken.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 8.5%, superiore al 95.0% delle vulnerabilità.
Correzione: aggiornare a 4.2.2 o successiva.

Package	Affected versions	Patched versions
jsonwebtoken auth0	`< 4.2.2`	`4.2.2`
jsonwebtoken npm	`< 4.2.2`	`4.2.2`

Description

Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm.

Recommendation

Update to version 4.2.2 or later.

NVD description

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

References

nvd.nist.gov/vuln/detail/CVE-2015-9235 · ADVISORY
auth0/node-jsonwebtoken commit 1bb584b · WEB
auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries · WEB
GitHub Advisory GHSA-c7hr-j4mj-j2w6 · ADVISORY
npmjs.com/advisories/17 · WEB
timmclean.net/2015/02/25/jwt-alg-none.html · WEB
auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries · Broken Link
nodesecurity.io/advisories/17 · Third Party Advisory

Altre vulnerabilità di jsonwebtoken

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

jsonwebtoken

auth0

< 4.2.2

4.2.2

jsonwebtoken

npm

< 4.2.2

4.2.2

Description

Recommendation

Update to version 4.2.2 or later.

NVD description

Altre vulnerabilità di jsonwebtoken

Vedi tutto →