What’s Vulnerable › Vulnerabilities

CVE-2022-25898: Improper Verification of Cryptographic Signature

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-07-01 · updated 2026-06-22
• Weakness: CWE-347

Description

The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.

Affected products

• jsrsasign: from 4.8.0 before 10.5.25 — fixed in 10.5.25

How to fix

Upgrade to a fixed version: jsrsasign 10.5.25. Check the vendor advisory for mitigations.

References

• https://github.com/kjur/jsrsasign/commit/4536a6e9e8bcf1a644ab7c07ed96e453347dae41
• https://github.com/kjur/jsrsasign/releases/tag/10.5.25
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2935898
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-2935897
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2935896
• https://snyk.io/vuln/SNYK-JS-JSRSASIGN-2869122
• https://github.com/kjur/jsrsasign/commit/4536a6e9e8bcf1a644ab7c07ed96e453347dae41
• https://github.com/kjur/jsrsasign/releases/tag/10.5.25
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2935898
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-2935897
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2935896
• https://snyk.io/vuln/SNYK-JS-JSRSASIGN-2869122

Get alerted when CVE-2022-25898 or the next vulnerability affects your stack