Weak Encryption Vulnerability in JOSE Product by Panva
CVE-2025-45767

7HIGH

Key Information:

Vendor

Panva

Status
JOSE
Vendor
CVE Published:
1 August 2025

What is CVE-2025-45767?

The JOSE library version 6.0.10, developed by Panva, has been identified with a vulnerability stemming from weak encryption practices. This flaw can potentially expose sensitive data to unauthorized access, thereby compromising the security integrity of applications using this version. It is highly recommended to update to a patched version to mitigate potential risks associated with this vulnerability.

References

https://github.com/panva
https://github.com/panva/jose
https://gist.github.com/ZupeiNie/705a606fbb99f3bb8c9b51e5...

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.