Improper Signature Verification in Node.js JSON Web Signature Implementation by Auth0
CVE-2025-65945
Key Information:
Badges
What is CVE-2025-65945?
The node-jws library by Auth0 suffers from an improper signature verification flaw, particularly when employing the HS256 algorithm under certain conditions. This vulnerability arises in applications that utilize the jws.createVerify() function for HMAC algorithms while allowing user-provided data in the JSON Web Signature's protected header or payload for HMAC secret lookups. This can potentially enable attackers to bypass the intended signature verification, compromising the integrity of the signed data. Essential patches have been released in versions 3.2.3 and 4.0.1 to address the issue.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
node-jws < 3.2.3 < 3.2.3
node-jws >= 4.0.0, <= 4.0.1 <= 4.0.0, 4.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved