Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
5 JWT mistakes I see in production: → `alg: none` tokens accepted → RS256 key as HS256 secret (CVE-2015-9235) → No exp/aud validation → Refresh tokens that never expire → Credentials in localStorage Fix: explicit alg, httpOnly cookies, PKCE for OAuth.
Post summary
Highlights common JWT misconfigurations, cites CVE-2015-9235, and offers mitigation steps like explicit algorithm enforcement, httpOnly cookies, and PKCE for OAuth.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | auth0 | jsonwebtoken | - | node.js | - |