PT-2022-16061 · Npm · Jsonwebtoken

Julienwoll · Published 2022-12-22 · Updated 2026-06-04 · CVE-2022-23540

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions <=8.5.1

Description The issue arises from the lack of algorithm definition in the jwt.verify() function, leading to a signature validation bypass due to defaulting to the none algorithm for signature verification. This occurs when no algorithms are specified in the jwt.verify() function and a falsy secret or key is used. Users are affected if they receive a token with no signature, do not specify algorithms, and pass a falsy secret or key.

Recommendations For jsonwebtoken versions <=8.5.1, update to version 9.0.0 to remove the default support for the none algorithm in the jwt.verify() method. If the none algorithm is needed, explicitly specify it in the jwt.verify() options.

Exploit

Fix

Improper Verification of Cryptographic Signature

Improper Authentication

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-347

CWE-287

CWE-327

Related Identifiers

CVE-2022-23540

GHSA-QWPH-4952-7XR6

Affected Products

Jsonwebtoken

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23540.json · Exploit
• https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23540 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23540 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2022-23540 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qwph-4952-7xr6 · Vendor Advisory
• https://github.com/auth0/node-jsonwebtoken · Note
• https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6 · Note
• https://security.netapp.com/advisory/ntap-20240621-0007 · Note