Read the docs
TI-2022-07596 Aliases CVE-2022-23541GHSA-hjrf-2m68-5959

Improper authentication in auth0 node-jsonwebtoken

Priority LOW 30CWE-1259Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0081 57th percentileScored 2026-11-07
Fix Partial jsonwebtoken (npm): 9.0.0Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
auth0node-jsonwebtokenup to 8.5.1—No fix listedCNA
—jsonwebtoken (npm)before 9.0.09.0.0Patch availableGHSA-hjrf-2m68-5959
  • node-jsonwebtoken Vendorauth0 Affected up to 8.5.1 Fixed in — No fix listed CNA
  • jsonwebtoken (npm) Vendor— Affected before 9.0.0 Fixed in 9.0.0 Patch available GHSA-hjrf-2m68-5959

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:*up to 8.5.1Vulnerableauth0
  • cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:* Versions up to 8.5.1 Vulnerable ·auth0

Remediation

  • Fix · GHSA-hjrf-2m68-5959 jsonwebtoken (npm) Fixed in 9.0.0 Advisory →

Red Hat 1 advisory

  • RHSA-2023:3742 Released 2023-06-21 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update
    • RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
RHODF 4.13 for RHEL 9Fixed RHSA-2023:3742
Not affected: 1 product
  • RHODF 4.13 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23541
  2. 2026-10-03 Alias added: GHSA-hjrf-2m68-5959

References

Patch 1

Advisory 2

Other 4

  • TI-2015-07615 Improper input validation in HackerOne jsonwebtoken node module CVSS 3.0CRITICAL 9.8
  • TI-2022-07594 jsonwebtoken unrestricted key type could lead to legacy keys usage CVSS 3.1HIGH 8.1
  • TI-2022-07595 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() CVSS 3.1HIGH 7.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences