CVE-2022-23541 is a medium-severity vulnerability in the auth0 jsonwebtoken library (versions <= 8.5.1) that allows for incorrect JWT verification. A misconfigured key retrieval function could enable forged tokens, signed with an asymmetric public key, to be validated using a symmetric HS256 algorithm. This could lead to unauthorized access or data manipulation. While the CVSS score is 6.3, indicating a network-exploitable, low-complexity attack with limited impact on confidentiality, integrity, and availability, there is currently no evidence of active exploitation, public exploit code, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 8.5.1CPE matchmatch criteria | cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
Dec 22, 2022jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
Dec 22, 2022