PT-2022-16062 · Unknown · Jsonwebtoken

Julienwoll · Published 2022-12-22 · Updated 2026-06-04 · CVE-2022-23541

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions <= 8.5.1

Description The jsonwebtoken library can be misconfigured, leading to incorrect verification of tokens. This occurs when a poorly implemented key retrieval function is used, referring to the secretOrPublicKey argument. As a result, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm, allowing for successful validation of forged tokens. This issue affects applications that support both symmetric and asymmetric keys in the jwt.verify() implementation with the same key retrieval function.

Recommendations Update to version 9.0.0 to resolve the issue. If you are currently using a version of jsonwebtoken that is <= 8.5.1, updating to version 9.0.0 will fix the problem. As a temporary workaround, consider reviewing and correcting your key retrieval function to ensure it properly handles both symmetric and asymmetric keys. Restrict access to the jwt.verify() function to minimize the risk of exploitation until the update is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-1259

Related Identifiers

CVE-2022-23541

GHSA-HJRF-2M68-5959

Affected Products

Jsonwebtoken

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23541.json · Exploit
• https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23541 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2022-23541 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23541 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hjrf-2m68-5959 · Vendor Advisory
• https://github.com/auth0/node-jsonwebtoken · Note
• https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0 · Note
• https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959 · Note
• https://t.me/cibsecurity/55125 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240621-0007 · Note