Skip to content
OpenAdvisories
Critical Public exploit CVE-2015-9235 EUVD-2018-0569GHSA-c7hr-j4mj-j2w6

Verification Bypass in jsonwebtoken

Published May 29, 2018 · Updated Sep 16, 2024 · Assigned by hackerone

Vendor: HackerOne Product: jsonwebtoken node module Package: jsonwebtoken Ecosystem: npm

Description

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

Affected products

VendorProductAffectedFixed
HackerOne jsonwebtoken node module <4.2.2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 4 repositories

  • z-bool/Venom-JWT ★ 288 · Jan 27, 2025

    针对JWT渗透开发的漏洞验证/密钥爆破工具，针对CVE-2015-9235/空白密钥/未验证签名攻击/CVE-2016-10555/CVE-2018-0114/CVE-2020-28042的结果生成用于FUZZ，也可使用字典/字符枚举(包括JJWT)的方式进行爆破(JWT Crack)

  • Nxvh1337/CVE-2015-9235_JWT_key_confusion ★ 3 · Sep 10, 2023

    automate CVE-2015-9235 exploitation

  • aalex954/jwt-key-confusion-poc ★ 2 · Jan 13, 2022

    JWT Key Confusion PoC (CVE-2015-9235) Written for the Hack the Box challenge - Under Construction

  • tierChampion/POC_CVE-2015-9235 ★ 0 · Mar 11, 2026

    Demo of the algorithm confusion attack on various JWT libraries

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm jsonwebtoken < 4.2.2 4.2.2 GHSA-c7hr-j4mj-j2w6

References