VULNERABILITY INTELLIGENCE
CVE-2015-9235
CVSS score9.8 CRITICAL
EPSS probability8.52%
CISA KEVNot currently listed
Published2018-05-29
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
Weakness classification
- CWE-20: Improper Input Validation
- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Primary references
- support@hackerone.com — Broken Link, Vendor Advisory
- support@hackerone.com — Patch, Third Party Advisory
- support@hackerone.com — Third Party Advisory
- support@hackerone.com — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory