CVE-2015-9235

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

• CWE-20
• CWE-327

• https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/Broken Link, Vendor Advisory
• https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687Patch, Third Party Advisory
• https://nodesecurity.io/advisories/17Third Party Advisory
• https://www.timmclean.net/2015/02/25/jwt-alg-none.htmlExploit, Third Party Advisory
• https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/Broken Link, Vendor Advisory
• https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687Patch, Third Party Advisory
• https://nodesecurity.io/advisories/17Third Party Advisory
• https://www.timmclean.net/2015/02/25/jwt-alg-none.htmlExploit, Third Party Advisory

Published

May 29, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-9229In the nggallery-manage-gallery page in the Photocrati NextG…4.8
• CVE-2015-9230In the admin/db-backup-security/db-backup-security.php page …4.8
• CVE-2015-9231iTerm2 3.x before 3.1.1 allows remote attackers to discover …
• CVE-2015-9232The Good for Enterprise application 3.0.0.415 for Android do…
• CVE-2015-9233The cp-contact-form-with-paypal (aka CP Contact Form with Pa…8.8
• CVE-2015-9234The cp-contact-form-with-paypal (aka CP Contact Form with Pa…
• CVE-2015-9236Hapi versions less than 11.0.0 implement CORS incorrectly an…
• CVE-2015-9238secure-compare 3.0.0 and below do not actually compare two s…
• CVE-2015-9239ansi2html is vulnerable to regular expression denial of serv…7.5
• CVE-2015-9240Due to a bug in the the default sign in functionality in the…
• CVE-2015-9241Certain input passed into the If-Modified-Since or Last-Modi…
• CVE-2015-9242Certain input strings when passed to new Date() or Date.pars…