TI-2015-07615 Aliases CVE-2015-9235 GHSA-c7hr-j4mj-j2w6

Improper input validation in HackerOne jsonwebtoken node module

MEDIUM 53CWE-20Published 2018-05-29 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-327.

Summary

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

Why it matters now

EPSS 0.08367 94th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed jsonwebtoken node module (HackerOne): 4.2.2jsonwebtoken (npm): 4.2.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HackerOne	jsonwebtoken node module	before 4.2.2	4.2.2	Patch available	CNA
—	jsonwebtoken (npm)	before 4.2.2	4.2.2	Patch available	GHSA-c7hr-j4mj-j2w6

jsonwebtoken node module VendorHackerOne Affected before 4.2.2 Fixed in 4.2.2 Patch available CNA
jsonwebtoken (npm) Vendor— Affected before 4.2.2 Fixed in 4.2.2 Patch available GHSA-c7hr-j4mj-j2w6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:auth0:jsonwebtoken::::::node.js::*	before 4.2.2	Vulnerable	auth0

cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:* Versions before 4.2.2 Vulnerable ·auth0

Remediation

Fix · CNA jsonwebtoken node module (HackerOne) Fixed in 4.2.2
Fix · GHSA-c7hr-j4mj-j2w6 jsonwebtoken (npm) Fixed in 4.2.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product

Red Hat Mobile Application Platform 4

Timeline

2026-10-02 Threatist record created from CVE-2015-9235
2026-10-03 Alias added: GHSA-c7hr-j4mj-j2w6
2026-10-19 EPSS moved to the 95th–99th percentile
2026-11-07 EPSS moved to the 90th–95th percentile

References

Exploit 1

https://www.timmclean.net/2015/02/25/jwt-alg-none.html

Patch 1

https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687

Advisory 4

Other 2

TI-2022-07594 jsonwebtoken unrestricted key type could lead to legacy keys usage CVSS 3.1HIGH 8.1
TI-2022-07595 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() CVSS 3.1HIGH 7.6
TI-2022-07596 Improper authentication in auth0 node-jsonwebtoken CVSS 3.1MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences