7.7
High
CVE-2022-25898 The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or…
Description
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| jsrsasign 10.5 | earliest → < 10.5.25 | 10.5.25 |
References
- snyk.io snyk.io
- snyk.io snyk.io
- snyk.io snyk.io
- snyk.io snyk.io
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of jsrsasign
The 8 CVEs of jsrsasign →
CVE-2026-4603
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL…
5.9
Medium
CVE-2026-4601
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the…
8.7
High
CVE-2026-4599
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing…
9.1
Critical
CVE-2026-4598
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in…
7.5
High