CVE-2022-25898
HighCVSS 7.7Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
The jsrsasign package before version 10.5.25 is vulnerable to improper verification of cryptographic signatures, which may lead to incorrect validation of JWS or JWT signatures containing invalid Base64URL encoding characters.
Risk Assessment
Organizations may be exposed to attacks where unauthorized signatures could be mistakenly accepted as valid, potentially leading to security breaches.
Recommendation
It is recommended to validate JWS or JWT signatures to ensure they contain safe Base64URL strings and dots before executing the JWS.verify() or JWS.verifyJWT() methods.
Other vulnerabilities in jsrsasign
See all- CVE-2026-4599Critical
The jsrsasign library versions 7.0.0 up to 11.1.0 are vulnerable to incomplete comparison in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. An attacker can recover the private key by exploiting incorrect compareTo checks that accept out-of-range candidates, biasing DSA nonces during signature generation.
- CVE-2021-30246Critical
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. There is no known practical attack exploiting this vulnerability.
- CVE-2026-4603Medium
Versions of the jsrsasign package before 11.1.1 are vulnerable to division by zero, potentially leading to incorrect RSA public-key operations. An attacker can force these operations to return predetermined zero outputs, hiding 'invalid key' errors.
- CVE-2026-4602High
A vulnerability in the jsrsasign library before version 11.1.1 is due to incorrect conversion between numeric types when handling negative exponents in the ext/jsbn2.js file. An attacker can force the computation of incorrect modular inverses and break signature verification by calling modPow with a negative exponent.
- CVE-2026-4601High
The jsrsasign library before version 11.1.1 is vulnerable to a missing cryptographic step in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, causing an invalid signature without retrying.
- CVE-2026-4600High
The jsrsasign library before version 11.1.1 is vulnerable to Improper Verification of Cryptographic Signature via DSA domain-parameter validation. An attacker can forge DSA signatures or X.509 certificates accepted by X509.verifySignature() by supplying malicious domain parameters (e.g., g=1, y=1, r=1).
- CVE-2026-4598High
A vulnerability in the jsrsasign library before version 11.1.1 causes an infinite loop in the bnModInverse function in ext/jsbn2.js. An attacker can permanently hang the process by passing zero or negative values to the BigInteger.modInverse method.
- CVE-2024-21484High
Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw.
- CVE-2020-14966High
An issue was discovered in the jsrsasign package through 8.0.18 for Node.js, allowing malleability in ECDSA signatures due to not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. Modified signatures are verified as valid.
Original NVD description (English source)
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.