CVE-2023-48238

CVE-2023-48238 affects the javascript library joaquimserafim/json-web-token. The root cause is that the library’s verify flow uses the JWT-supplied algorithm (potentially HS256) before the token is verified, enabling an algorithm-confusion attack against applications using RS256. Attackers can cr...