Auth0 Jsonwebtoken vulnerabilities

CVE-2015-9235 [CRITICAL] CWE-20 CVE-2015-9235: In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

CVE-2022-23539 [HIGH] CWE-327 CVE-2022-23539: Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key typ Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue

CVE-2026-25537 [MEDIUM] CWE-843 jsonwebtoken has Type Confusion that leads to potential authorization bypass jsonwebtoken has Type Confusion that leads to potential authorization bypass ## Summary: It has been discovered that there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim (such as nbf or exp) is provided with an incorrect JSON type (Like a String instead of a Number), the library’s internal parsing mechanism marks th

CVE-2022-23540 [HIGH] CWE-287 CVE-2022-23540: In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version

CVE-2022-23541 [MEDIUM] CWE-287 CVE-2022-23541: jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm a

CVE-2022-23529 [HIGH] CWE-20 jsonwebtoken has insecure input validation in jwt.verify function jsonwebtoken has insecure input validation in jwt.verify function # Overview For versions `<=8.5.1` of `jsonwebtoken` library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the `secretOrPublicKey` argument from the [readme link](https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback)) of the `jwt.verify()` function, they