PT-2025-49117 · Auth0 · Node.Js

Published 2025-12-04 · Updated 2026-04-01 · CVE-2025-65945

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions auth0/node-jws versions 3.2.2 and earlier auth0/node-jws version 4.0.0

Description auth0/node-jws is a JSON Web Signature implementation for Node.js. A flaw exists in signature verification when using the HS256 algorithm under specific conditions. Applications utilizing the jws.createVerify() function for HMAC algorithms, and incorporating user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, may be susceptible to bypassing signature verification. The issue occurs when the username or other user-controlled data is used directly or indirectly in the process of generating the HMAC key.

Recommendations Update to auth0/node-jws version 3.2.3 or later. Update to auth0/node-jws version 4.0.1 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CLEANSTART-2026-IL36032

CVE-2025-65945

GHSA-869P-CJFG-CM3X

Affected Products

Node.Js

References · 48

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65945.json · Exploit
• https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x · Vendor Advisory
• https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-65945 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-IL36032 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65945 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-869p-cjfg-cm3x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49005 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-65945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30218 · Security Note
• https://github.com/auth0/node-jws/releases/tag/v4.0.1 · Note
• https://github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6 · Note
• https://github.com/auth0/node-jws/releases/tag/v3.2.3 · Note
• https://github.com/auth0/node-jws · Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IL36032.json · Note