Jsonwebtoken (Auth0) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 79 known versions, newest CVE from 2022-12-23. Vendor: Auth0.

CVEs of Jsonwebtoken

• CVE-2022-23539 - CVSS 8.1 (high), 2022-12-23: Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA…
• CVE-2022-23540 - CVSS 7.6 (high), 2022-12-22: In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to…
• CVE-2022-23541 - CVSS 6.3 (medium), 2022-12-22: jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented…
• CVE-2015-9235 - CVSS 9.8 (critical), 2018-05-29: In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES…