What’s Vulnerable › Vulnerabilities

CVE-2023-23928: reason-jose ignores signature checks

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-01 · updated 2026-06-17
• Weakness: CWE-347

Description

reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass. Applications relying on JWS claims assertion to enforce security boundaries may be vulnerable to privilege escalation. This issue has been patched in version 0.8.2.

Affected products

• ulrikstrid reason-jose: before 0.8.2 — fixed in 0.8.2

How to fix

Upgrade to a fixed version: ulrikstrid reason-jose 0.8.2. Check the vendor advisory for mitigations.

References

• https://github.com/ulrikstrid/reason-jose/commit/36cd724db3cbec121757624da49072386bd869e5
• https://github.com/ulrikstrid/reason-jose/releases/tag/v0.8.2
• https://github.com/ulrikstrid/reason-jose/security/advisories/GHSA-7jj9-6qwv-wpm7
• https://github.com/ulrikstrid/reason-jose/commit/36cd724db3cbec121757624da49072386bd869e5
• https://github.com/ulrikstrid/reason-jose/releases/tag/v0.8.2
• https://github.com/ulrikstrid/reason-jose/security/advisories/GHSA-7jj9-6qwv-wpm7

Get alerted when CVE-2023-23928 or the next vulnerability affects your stack