auth0 Vulnerabilities and Affected Products
Vulnerabilities associated with node-jws.
Products
Clear product- nextjs-auth07 vulnerabilities
- auth0-PHP4 vulnerabilities
- lock3 vulnerabilities
- node-jsonwebtoken3 vulnerabilities
- passport-wsfed-saml23 vulnerabilities
- auth0.js2 vulnerabilities
- express-openid-connect2 vulnerabilities
- ad-ldap-connector1 vulnerability
- express-jwt1 vulnerability
- laravel-auth01 vulnerability
- Login by Auth01 vulnerability
- node-auth01 vulnerability
- node-jws1 vulnerability
- omniauth-auth01 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-65945HIGH | auth0/node-jws improper HMAC signature verification vulnerabilityauth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verif… CWE-347Dec 4, 2025 | CVSS7.5v3.1 | EPSS0.219% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |