CVE-2015-9235

CVE-2015-9235 describes a critical vulnerability in the auth0 jsonwebtoken node module prior to version 4.2.2, allowing attackers to bypass token verification. This flaw enables an attacker to submit a token signed with a symmetric algorithm (HS family) even when the system expects an asymmetric signature (RS/ES family), leading to unauthorized access. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low attack complexity, potentially resulting in complete compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, its high FAUCET Risk Score of 96/100 indicates a severe potential impact.