CVE-2022-25898: JWS and JWT signature validation vulnerability in jsrsasign
Summary
CVE-2022-25898: JWS and JWT signature validation vulnerability with special characters. Affects jsrsasign versions >= 4.8.0, < 10.5.25. Fixed in 10.5.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jsrsasign is an open-source library that supports JWS (JSON Web Signatures) and JWT (JSON Web Token) validation. It is commonly used in OpenID Connect and OAuth2 implementations for authentication and authorization. The library provides methods for verifying the integrity and authenticity of JWS and JWT signatures. However, a vulnerability exists in the library's signature validation logic, which can mistakenly validate signatures with non Base64URL encoding special characters or number escaped characters. This vulnerability can potentially lead to unauthorized access or privilege escalation in affected systems.
Vulnerability Detail
The vulnerability in jsrsasign allows JWS or JWT signatures with non Base64URL encoding special characters or number escaped characters to be validated as valid. This means that even if a string of non Base64URL encoding characters such as !@$% or \11 is inserted into a valid JWS or JWT signature value string, it will still be considered a valid signature. This can be exploited by an attacker to bypass authentication or authorization mechanisms that rely on the integrity and authenticity of JWS or JWT signatures. The vulnerability has a CVSS 3.1 score of 8.6.
How To Fix
Latest published version: 11.1.5 as of 23 Oct 2026
npm install jsrsasign@11.1.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.5.25
This is the first release that contains the fix.
npm install jsrsasign@10.5.25Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually validate JWS or JWT signatures before executing the JWS.verify() or JWS.verifyJWT() methods. This can be done by checking if the signature string contains only Base64URL and dot safe characters using the isBase64URLDot method from the global__ namespace. If the signature contains any non-safe characters, it should be considered invalid.
Conclusion
The vulnerability in jsrsasign's JWS and JWT signature validation can allow for the acceptance of invalid signatures, potentially leading to unauthorized access or privilege escalation. Users should upgrade to the latest version of jsrsasign (10.5.25 or later) to fix this vulnerability. Additionally, manual validation of signatures can be performed as a workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jsrsasign →
FAQ
jsrsasign is an open-source library that provides support for JWS (JSON Web Signatures) and JWT (JSON Web Token) validation. It is commonly used in OpenID Connect and OAuth2 implementations for authentication and authorization.
The vulnerability allows JWS or JWT signatures with non Base64URL encoding special characters or number escaped characters to be mistakenly validated as valid. This can lead to unauthorized access or privilege escalation in affected systems.
To fix this vulnerability, users of jsrsasign should upgrade to version 10.5.25 or later, which includes a patch that addresses the signature validation issue.
Yes, as a workaround, users can manually validate JWS or JWT signatures before executing the JWS.verify() or JWS.verifyJWT() methods. This can be done by checking if the signature string contains only Base64URL and dot safe characters.
The CVSS 3.1 score of this vulnerability is 8.6, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for jsrsasign.
