Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-rb3t-ssvc-k3gz
Vulnerability ID VCID-rb3t-ssvc-k3gz
Aliases CVE-2022-23541
GHSA-hjrf-2m68-5959
Summary jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-287 Improper Authentication
CWE-1259 Improper Restriction of Security Token Assignment
CWE-347 Improper Verification of Cryptographic Signature
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.0 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23541.json
epss 0.0006 https://api.first.org/data/v1/epss?cve=CVE-2022-23541
epss 0.0006 https://api.first.org/data/v1/epss?cve=CVE-2022-23541
epss 0.0006 https://api.first.org/data/v1/epss?cve=CVE-2022-23541
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-hjrf-2m68-5959
cvssv3.1 5.0 https://github.com/auth0/node-jsonwebtoken
generic_textual MODERATE https://github.com/auth0/node-jsonwebtoken
cvssv3.1 5 https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
cvssv3.1 5.0 https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
generic_textual MODERATE https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
ssvc Track https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
cvssv3.1 5 https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
cvssv3.1 5.0 https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
generic_textual MODERATE https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
ssvc Track https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
cvssv3.1 5 https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
cvssv3.1 5.0 https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
cvssv3.1_qr MODERATE https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
generic_textual MODERATE https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
ssvc Track https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
cvssv3.1 5.0 https://nvd.nist.gov/vuln/detail/CVE-2022-23541
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-23541
cvssv3.1 5.0 https://security.netapp.com/advisory/ntap-20240621-0007
generic_textual MODERATE https://security.netapp.com/advisory/ntap-20240621-0007
cvssv3.1 5 https://security.netapp.com/advisory/ntap-20240621-0007/
ssvc Track https://security.netapp.com/advisory/ntap-20240621-0007/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23541.json
https://api.first.org/data/v1/epss?cve=CVE-2022-23541
https://github.com/auth0/node-jsonwebtoken
https://nvd.nist.gov/vuln/detail/CVE-2022-23541
https://security.netapp.com/advisory/ntap-20240621-0007
2169375 https://bugzilla.redhat.com/show_bug.cgi?id=2169375
e1fa9dcc12054a8681db4e6373da1b30cf7016e3 https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
GHSA-hjrf-2m68-5959 https://github.com/advisories/GHSA-hjrf-2m68-5959
GHSA-hjrf-2m68-5959 https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
ntap-20240621-0007 https://security.netapp.com/advisory/ntap-20240621-0007/
RHSA-2023:3742 https://access.redhat.com/errata/RHSA-2023:3742
v9.0.0 https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23541.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/auth0/node-jsonwebtoken
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T17:50:35Z/ Found at https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T17:50:35Z/ Found at https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T17:50:35Z/ Found at https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2022-23541
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://security.netapp.com/advisory/ntap-20240621-0007
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://security.netapp.com/advisory/ntap-20240621-0007/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-03T17:50:35Z/ Found at https://security.netapp.com/advisory/ntap-20240621-0007/
Exploit Prediction Scoring System (EPSS)
Percentile 0.19083
EPSS Score 0.0006
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:36:28.706608+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2022/23xxx/CVE-2022-23541.json 38.6.0