# CVE-2022-23540: Auth0 jsonwebtoken signature validation bypass via default algorithm

Source: https://junglewise.ai/threats/cve-2022-23540-auth0-jsonwebtoken-signature-validation-bypass-via-default  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-12-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-23540 · Severity: low · CVSS 3.1 · Published 2022-12-22

Auth0's jsonwebtoken library is used to verify digital signatures on JSON Web Tokens, which are commonly used for authentication in web applications and APIs. Versions up to 8.5.1 contain a flaw where the library defaults to accepting unsigned tokens when no algorithm is explicitly specified and a weak or missing secret is provided. An attacker could forge valid-looking tokens without a valid signature, allowing account takeover or unauthorized access to protected resources.

Technologies: [jsonwebtoken (npm)](https://junglewise.ai/threats/technologies/jsonwebtoken). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-23540 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-23540 being exploited in the wild.

**How severe is CVE-2022-23540?** Low severity, with a CVSS score of 3.1, published 22 December 2022.

**Which products and versions are affected?** jsonwebtoken (npm) SEMVER:introduced=0,fixed=9.0.0.

**Is there a fix for CVE-2022-23540?** Yes. jsonwebtoken (npm): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-23540 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-23540?** Check whether you run jsonwebtoken (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jsonwebtoken (npm): upgrade to 9.0.0 or later

  ```sh
  npm install jsonwebtoken@9.0.0
  ```


## Technical details

The vulnerability is a signature validation bypass (CWE-287, CWE-327, CWE-347) affecting jsonwebtoken ≤8.5.1. When jwt.verify() is called with no algorithm specified and a falsy secret (null, false, undefined), the library defaults to accepting the "none" algorithm, which skips cryptographic validation entirely. An attacker can present an unsigned or self-signed token and it will be accepted as valid. The attack requires network access to an application using the vulnerable library and occurs without authentication or user interaction. The vulnerability is fixed in version 9.0.0, which removes default support for the "none" algorithm.

## Affected products

- Auth0 jsonwebtoken <=8.5.1

## Identifiers

- CVE-2022-23540
- GHSA-qwph-4952-7xr6

## Timeline

- 2022-12-22: disclosed
- 2022-12-22: patched: Version 9.0.0 released

## References

- [https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6](https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6)

## Related threats

- [jsonwebtoken insecure key retrieval leading to token forgery](https://junglewise.ai/threats/cve-2022-23541-jsonwebtoken-insecure-key-retrieval-leading-to-token-forgery)
- [jsonwebtoken unrestricted key type in signature verification](https://junglewise.ai/threats/cve-2022-23539-jsonwebtoken-unrestricted-key-type-in-signature-verification)
- [Auth0 jsonwebtoken insecure input validation in jwt.verify](https://junglewise.ai/threats/auth0-jsonwebtoken-insecure-input-validation-in-jwt-verify-d6e47a79)
- [Auth0 jsonwebtoken verification bypass](https://junglewise.ai/threats/cve-2015-9235-auth0-jsonwebtoken-verification-bypass)