CVE-2015-9235
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 8.7%
exploitation probability
8.7%top 5% of all CVEs
observed exploitation
nono source reports it
In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
Affected products
HackerOne · jsonwebtoken node module