CVE-2023-23928

Name: CVE-2023-23928
Creator: NVD / NIST
Published: 2023-02-01T01:15:09.023+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 0.46%

Last modified Jun 17, 2026

CVE-2023-23928 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. EPSS estimates a 0.46% chance of exploitation in the next 30 days.

Description

reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass. Applications relying on JWS claims assertion to enforce security boundaries may be vulnerable to privilege escalation. This issue has been patched in version 0.8.2.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.46%

36.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-347

Affected Software

Vendor	Product	Versions
Reason-Jose Project	Reason-Jose	< 0.8.2

References

https://github.com/ulrikstrid/reason-jose/commit/36cd724db3cbec121757624da49072386bd869e5Patch, Third Party Advisory
https://github.com/ulrikstrid/reason-jose/releases/tag/v0.8.2Release Notes, Third Party Advisory
https://github.com/ulrikstrid/reason-jose/security/advisories/GHSA-7jj9-6qwv-wpm7Third Party Advisory
https://github.com/ulrikstrid/reason-jose/commit/36cd724db3cbec121757624da49072386bd869e5Patch, Third Party Advisory
https://github.com/ulrikstrid/reason-jose/releases/tag/v0.8.2Release Notes, Third Party Advisory
https://github.com/ulrikstrid/reason-jose/security/advisories/GHSA-7jj9-6qwv-wpm7Third Party Advisory

Timeline

Published: Feb 1, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-23928?

How severe is CVE-2023-23928?

CVE-2023-23928 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.46% probability of exploitation in the next 30 days.

How do I fix CVE-2023-23928?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-23928?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST