PT-2025-49117

🗓️ 04 Dec 2025 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

Auth0 node-jws had improper HS256 signature verification with user data; fixed in 3.2.3 and 4.0.1.

Reporter	Title	Published	Views	Family All 70
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	30 Jan 202609:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Security QRadar EDR Software	11 Feb 202616:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Streams	12 Mar 202612:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules (CVE-2025-64718, CVE-2025-64756, CVE-2025-13466 & CVE-2025-65945)	22 Dec 202511:27	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	2 Feb 202614:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service (CVE-2025-12758, CVE-2025-13466, CVE-2025-14874) and loss of confidentiality (CVE-2025-65945)	5 Feb 202612:45	–	ibm
IBM Security Bulletins	Security Bulletin: auth0/node-jws HS256 signature verification bypass via improper HMAC secret handling (≤3.2.2, 4.0.0)	3 Feb 202609:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	2 Mar 202611:21	–	ibm
IBM Security Bulletins	Security Bulletin: Signature Verification Bypass Vulnerability in auth0/node-jws (HS256, ≤ v3.2.2 & v4.0.0) affects watsonx.data	8 Apr 202608:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	26 Feb 202610:04	–	ibm

Source	Link
twitter	www.twitter.com/CVEnew/status/1996654588909265384
github	www.github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x
osv	www.osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-65945
t	www.t.me/CVEtracker/38859
twitter	www.twitter.com/dailycve/status/2031217392521720076
osv	www.osv.dev/vulnerability/GHSA-869p-cjfg-cm3x
github	www.github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6
github	www.github.com/auth0/node-jws/releases/tag/v3.2.3
github	www.github.com/auth0/node-jws/releases/tag/v4.0.1
github	www.github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e

10 Mar 2026 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.17.5

EPSS0.00012

SSVC

Auth0 node-jws HS256 vulnerability signature verification jws createVerify secret lookup patched versions 3.2.3 4.0.1