CVE-2022-23539 affects versions <=8.5.1 of the jsonwebtoken library, allowing misconfiguration where legacy, insecure key types can be used for signature verification, such as DSA keys with the RS256 algorithm. This vulnerability is rated 8.1 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating it can be exploited remotely with low complexity by an authenticated user, leading to high confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage. The issue is fixed in version 9.0.0, which validates asymmetric key type and algorithm combinations, though a workaround exists for continued use of invalid combinations.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 8.5.1CPE matchmatch criteria | cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.