PT-2025-49117 · Auth0 · Node.Js

CVE-2025-65945 · Publicado 2025-12-04 · Atualizado 2026-06-04

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions auth0/node-jws versions 3.2.2 and earlier auth0/node-jws version 4.0.0

Description auth0/node-jws is a JSON Web Signature implementation for Node.js. A flaw exists in signature verification when using the HS256 algorithm under specific conditions. Applications utilizing the jws.createVerify() function for HMAC algorithms, and incorporating user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, may be susceptible to bypassing signature verification. The issue occurs when the username or other user-controlled data is used directly or indirectly in the process of generating the HMAC key.

Recommendations Update to auth0/node-jws version 3.2.3 or later. Update to auth0/node-jws version 4.0.1 or later.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CLEANSTART-2026-IL36032

CVE-2025-65945

ECHO-C071-DE61-1600

GHSA-869P-CJFG-CM3X

Produtos afetados

Node.Js

Referências · 48

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65945.json · Exploit
• https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x · Aviso do Fabricante
• https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e · Correção
• https://github.com/auth0/node-jws · Nota
• https://github.com/auth0/node-jws/releases/tag/v4.0.1 · Nota
• https://github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6 · Nota
• https://github.com/auth0/node-jws/releases/tag/v3.2.3 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IL36032.json · Nota
• https://twitter.com/TheExploitLab/status/2003116164780797966 · Publicação no Twitter
• https://osv.dev/vulnerability/CLEANSTART-2026-IL36032 · Aviso do Fabricante
• https://osv.dev/vulnerability/ghsa-4992-7rv2-5pvq · Nota
• https://t.me/CVEtracker/38859 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-65945 · Aviso do Fabricante
• https://osv.dev/vulnerability/ghsa-rcmh-qjqh-p98v · Nota
• https://osv.dev/vulnerability/ghsa-m7jm-9gc2-mpf2 · Nota