AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OktaOKTA-0RXNV4B

Improper HMAC Signature Verification in auth0/node-jws

Okta

CVE-2025-65945 · Published Dec 4, 2025

High7.5
No fix yet
Okta advisory

An improper signature verification vulnerability exists when using auth0/node-jws with the HS256 algorithm under specific conditions. To remediate, upgrade auth0/node-jws version to version 3.2.3 or 4.0.1.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 12Severity: Unrated to High
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity from
NVD

More Okta advisories

All Okta
High 8.2Apr 1Insufficient Entropy in Cookie Encryption in Auth0 Symfony SDKCVE-2026-34236no fix yetHigh 8.4Dec 10, 2025Race condition in the Okta Java SDKCVE-2025-67505no fix yetMedium 5.3Dec 10, 2025Improper Memory Cleanup in the Okta Java SDKCVE-2025-66033no fix yetMedium 5.4Dec 10, 2025Improper Request Caching Lookup in the Auth0 Next.js SDKCVE-2025-67490no fix yetMedium 5.7Dec 10, 2025Improper Validation of Query Parameters in Auth0 Next.js SDKCVE-2025-67716no fix yetLow 3.3Oct 1, 2025Improper File Type Handling in Bulk User Import in Auth0 Wordpress pluginCVE-2025-58769no fix yet