Read the docs
TI-2022-07595 Aliases CVE-2022-23540GHSA-qwph-4952-7xr6

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

Priority LOW 34CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
Low · High · Low
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287 and CWE-327.

Summary

In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00572 47th percentileScored 2026-11-07
Fix Partial jsonwebtoken (npm): 9.0.0Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
auth0node-jsonwebtokenup to 8.5.1—No fix listedCNA
—jsonwebtoken (npm)before 9.0.09.0.0Patch availableGHSA-qwph-4952-7xr6
  • node-jsonwebtoken Vendorauth0 Affected up to 8.5.1 Fixed in — No fix listed CNA
  • jsonwebtoken (npm) Vendor— Affected before 9.0.0 Fixed in 9.0.0 Patch available GHSA-qwph-4952-7xr6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:*up to 8.5.1Vulnerableauth0
  • cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:* Versions up to 8.5.1 Vulnerable ·auth0

Remediation

  • Fix · GHSA-qwph-4952-7xr6 jsonwebtoken (npm) Fixed in 9.0.0 Advisory →

Red Hat 1 advisory

  • RHSA-2023:3742 Released 2023-06-21 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update
    • RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
RHODF 4.13 for RHEL 9Fixed RHSA-2023:3742
Not affected: 1 product
  • RHODF 4.13 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23540
  2. 2026-10-03 Alias added: GHSA-qwph-4952-7xr6

References

Patch 1

Advisory 2

Other 3

  • TI-2015-07615 Improper input validation in HackerOne jsonwebtoken node module CVSS 3.0CRITICAL 9.8
  • TI-2022-07594 jsonwebtoken unrestricted key type could lead to legacy keys usage CVSS 3.1HIGH 8.1
  • TI-2022-07596 Improper authentication in auth0 node-jsonwebtoken CVSS 3.1MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences