Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-8arv-3w13-g3f2
Vulnerability ID VCID-8arv-3w13-g3f2
Aliases CVE-2015-9235
GHSA-c7hr-j4mj-j2w6
Summary Verification Bypass in jsonwebtoken
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-20 Improper Input Validation
CWE-287 Improper Authentication
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-327 Use of a Broken or Risky Cryptographic Algorithm
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-9235.json
epss 0.37481 https://api.first.org/data/v1/epss?cve=CVE-2015-9235
epss 0.37481 https://api.first.org/data/v1/epss?cve=CVE-2015-9235
generic_textual CRITICAL https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-c7hr-j4mj-j2w6
generic_textual CRITICAL https://github.com/advisories/GHSA-c7hr-j4mj-j2w6
generic_textual CRITICAL https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2015-9235
generic_textual CRITICAL https://www.npmjs.com/advisories/17
generic_textual CRITICAL https://www.timmclean.net/2015/02/25/jwt-alg-none.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-9235.json
https://api.first.org/data/v1/epss?cve=CVE-2015-9235
https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
https://nodesecurity.io/advisories/17
https://www.npmjs.com/advisories/17
https://www.timmclean.net/2015/02/25/jwt-alg-none.html
1584880 https://bugzilla.redhat.com/show_bug.cgi?id=1584880
CVE-2015-9235 https://nvd.nist.gov/vuln/detail/CVE-2015-9235
GHSA-c7hr-j4mj-j2w6 https://github.com/advisories/GHSA-c7hr-j4mj-j2w6
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-9235.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.97288
EPSS Score 0.37481
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:24:19.989558+00:00 GHSA Importer Import https://github.com/advisories/GHSA-c7hr-j4mj-j2w6 38.6.0