CVE-2025-65945

Katalog CVE

CVSS 7.5 · High EPSS 0,22%

Kerentanan Improper Verification of Cryptographic Signature pada auth0 node-jws. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.

Rincian

Terbit di NVD

4 Desember 2025

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x advisory vendor
• https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e patch