CVE-2022-23541 jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

🗓️ 22 Dec 2022 17:52:22Reported by GoogleType

osv🔗 osv.dev👁 22 Views

jsonwebtoken library <= 8.5.1 misconfiguration allows incorrect token verification with different key combinations. Update to version 9.0.

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in jsonwebtoken package affects Data Replication on Cloud Pak for Data	7 Nov 202321:50	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in jsonwebtoken	3 Mar 202315:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions due to [CVE-2022-23539], [CVE-2022-23540] and [CVE-2022-23541]	28 Jun 202315:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Optimization in IBM Cloud Pak for Data is vulnerable to jsonwebtoken CVEs	17 Feb 202307:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Information Queue has multiple third-party library vulnerabilities	16 May 202316:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	20 Jun 202416:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to multiple jsonwebtoken CVEs	30 Jan 202310:40	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo Application Suite uses jsonwebtoken package which is vulnerable to CVE-2022-23541, CVE-2022-23539, CVE-2022-23529 and CVE-2022-23540	27 Mar 202320:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Json4j Affects Watson Machine Learning Accelerator	3 Mar 202320:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by a vulnerability in JSON Web Token	24 Feb 202313:19	–	ibm

Source	Link
github	www.github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23541.json
github	www.github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-23541
security	www.security.netapp.com/advisory/ntap-20240621-0007/
github	www.github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3

10 Apr 2026 04:45Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.15

EPSS0.0006