CVE-2025-65945 - CVE House

Back to Database

Status published High CVE-2025-65945

auth0/node-jws improper HMAC signature verification vulnerability

7.5 CVSS

Vulnerability Description

auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-65945

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from auth0

View All →

Auth0-PHP SDK has Improper Audience Validation

Auth0 Next.js SDK has Improper Validation of Query Parameters

Auth0 Next.js SDK has Improper Request Caching Lookup

auth0-PHP: Improper File Type Handling in Bulk User Import

Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

Affected Vendor

auth0

View all reports →

Affected Software

node-jws

Vulnerable Versions:

< 3.2.3, >= 4.0.0, <= 4.0.1

Timeline

Official Publish: December 4th, 2025

Last Modified: December 5th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1553 Subvert Trust Controls

Defense Evasion

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1565 Data Manipulation