A critical cryptographic flaw in the auth0/node-jws library allows unauthenticated attackers to bypass signature verification, potentially leading to unauthorized access or data manipulation.

The library fails to properly verify cryptographic signatures when the jws.createVerify() function is utilized with the HS256 algorithm. This occurs when applications incorporate user-provided data from headers or payloads into HMAC secret lookup routines, enabling an unauthenticated attacker to bypass verification entirely.

Successful exploitation allows an attacker to forge or manipulate JSON Web Tokens (JWTs), which are often used for session management and authorization. This bypass of security controls can lead to unauthorized access to sensitive application features or user data. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to the integrity of authentication flows across affected Node.js applications.

Immediate Action: Update the jws package to version 3.2.3 or 4.0.1 immediately via your package manager to incorporate the necessary cryptographic verification fixes.

Proactive Monitoring: Review application logs for unusual authentication patterns or failed token validation attempts that may indicate attempts to exploit signature verification logic.

Compensating Controls: Ensure that HMAC secret keys are not derived from user-supplied input, as this is the primary trigger for the vulnerability. Implement strict input validation and sanitization for any data used in cryptographic operations.

Public Exploit Available: Yes, a public proof-of-concept exists in a GitHub repository (https://github.com/jedisct1/CVE-2025-65945-poc).

The reliance on improper HMAC secret lookups makes this vulnerability a significant security risk for any application utilizing node-jws for token handling. Security teams should prioritize patching the dependency to the specified versions immediately to prevent potential bypass of authentication mechanisms. Failure to update may leave critical application entry points exposed to unauthorized manipulation.