Security Issue in JWT Secret Poisoning (Updated)
Summary: Unit 42 researchers reported CVE-2022-23529, a high-severity (CVSS 7.6) flaw in Auth0's JsonWebToken package, version 8.5.1 and earlier, where a malicious object passed as the secretOrPublicKey parameter to the verify method could execute code and achieve remote code execution. On Jan. 30, 2023, after community feedback on the exploitation prerequisites, Unit 42 and Auth0 retracted the CVE, stating the risk lies in insecure calling code rather than the library, while jsonwebtoken 9.0.0 added type checks on secretOrPublicKey and removed the vulnerable code.
Why it matters: The package had over 9 million weekly downloads and more than 20,000 dependents, and exploitation required an attacker to control or compromise the secret management process - so the exposure sits in how your code and secret managers handle keys, not in the library alone.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-23529
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026