PT-2018-4549 · Json Web Token · Jsonwebtoken

Published 2018-05-29 · Updated 2026-06-04 · CVE-2015-9235

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions 4.2.1 and earlier

Description The issue allows an attacker to bypass verification when a token digitally signed with an asymmetric key is sent, but the attacker instead sends a token digitally signed with a symmetric algorithm. This is due to weak validation of the JWT algorithm type, which occurs when an attacker is allowed to arbitrarily specify the JWT algorithm.

Recommendations Update to version 4.2.2 or later.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

RCE

Weakness Enumeration

CWE-327

CWE-20

Related Identifiers

CVE-2015-9235

GHSA-C7HR-J4MJ-J2W6

Affected Products

Jsonwebtoken

References · 10

• 🔥 https://github.com/WinDyAlphA/CVE-2015-9235_JWT_key_confusion · Exploit
• 🔥 https://timmclean.net/2015/02/25/jwt-alg-none.html · Exploit
• https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-9235 · Security Note
• https://osv.dev/vulnerability/GHSA-c7hr-j4mj-j2w6 · Vendor Advisory
• https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2015-9235 · Vendor Advisory
• https://nodesecurity.io/advisories/17 · Note
• https://github.com/advisories/GHSA-c7hr-j4mj-j2w6 · Note
• https://npmjs.com/advisories/17 · Note