CVE-2015-9235

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-327

Affected software

No affected versions have been published.

Timeline

Published: May 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-92365.3Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at w CVE-2015-92385.3secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, CVE-2015-92397.5ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.CVE-2015-92407.5Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched CVE-2015-92417.5Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of s CVE-2015-92427.5Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. Th CVE-2015-92435.9When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher leve CVE-2015-92449.8Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.CVE-2015-92459.8Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URL CVE-2015-92469.8An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archive containing a JSP f CVE-2015-92475.4An issue was discovered in Skybox Platform before 7.5.401. Reflected cross-site scripting vulnerabilities exist in /skyboxview/webservice/se CVE-2015-92485.4An issue was discovered in Skybox Platform before 7.5.201. Stored cross-site scripting vulnerabilities exist in the title, Comments, or Desc