Security Issue in JWT Secret Poisoning (Updated)
Unit 42 researchers reported CVE-2022-23529, a high-severity (CVSS 7.6) flaw in Auth0's JsonWebToken package, version 8.5.1 and earlier, where a malicious object passed as the secretOrPublicKey parameter to the verify method could execute code and achieve...