CVE-2022-23541

jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

• CWE-287
• CWE-1259

• https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3Patch
• https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0Release Notes
• https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240621-0007/
• https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3Patch
• https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0Release Notes
• https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240621-0007/

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23536Cortex provides multi-tenant, long term storage for Promethe…6.5
• CVE-2022-23537PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-23538github.com/sylabs/scs-library-client is the Go client for th…7.6
• CVE-2022-23539Versions `<=8.5.1` of `jsonwebtoken` library could be miscon…8.1
• CVE-2022-2354The WP-DBManager WordPress plugin before 2.80.8 does not pre…7.2
• CVE-2022-23540In versions `<=8.5.1` of `jsonwebtoken` library, lack of alg…7.6
• CVE-2022-23542OpenFGA is an authorization/permission engine built for deve…9.8
• CVE-2022-23543Silverware Games is a social network where people can play g…5.4
• CVE-2022-23544MeterSphere is a one-stop open source continuous testing pla…6.1
• CVE-2022-23546In version 2.9.0.beta14 of Discourse, an open-source discuss…5.5
• CVE-2022-23547PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-23548Discourse is an option source discussion platform. Prior to …6.5