CVE-2022-23540

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions <=8.5.1

Description The issue arises from the lack of algorithm definition in the jwt.verify() function, leading to a signature validation bypass due to defaulting to the none algorithm for signature verification. This occurs when no algorithms are specified in the jwt.verify() function and a falsy secret or key is used. Users are affected if they receive a token with no signature, do not specify algorithms, and pass a falsy secret or key.

Recommendations For jsonwebtoken versions <=8.5.1, update to version 9.0.0 to remove the default support for the none algorithm in the jwt.verify() method. If the none algorithm is needed, explicitly specify it in the jwt.verify() options.