CVE-2018-0114
Cisco node-jose improper validation of JWT signature
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.
- Record
CVE-2018-0114- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
CVE ListNo score
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.
- Record
CVE-2018-0114- Weakness
- CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2022-4353No score
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.
- Record
EUVD-2022-4353- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jfxm-w8g2-4rcv
Cisco node-jose improper validation of JWT signature
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.
- Record
GHSA-jfxm-w8g2-4rcv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSV
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.
- Record
CVE-2018-0114- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-jfxm-w8g2-4rcv
Cisco node-jose improper validation of JWT signature
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.
- Record
GHSA-jfxm-w8g2-4rcv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
node-josenpm | before 0.11.0 | 0.11.0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Cisco node-jos < 0.11.0 - Re-sign Tokens | 2018-03-20 |
| PoC in GitHub | zi0Black/POC-CVE-2018-0114 | 2018-03-20 |
| PoC in GitHub | Logeirs/CVE-2018-0114 | 2020-08-18 |
| PoC in GitHub | adityathebe/POC-CVE-2018-0114 | 2020-12-20 |
| PoC in GitHub | Eremiel/CVE-2018-0114 | 2021-01-03 |
| PoC in GitHub | Starry-lord/CVE-2018-0114 | 2021-01-13 |
| PoC in GitHub | scumdestroy/CVE-2018-0114 | 2021-05-11 |
| PoC in GitHub | j4k0m/CVE-2018-0114 | 2021-09-03 |
| PoC in GitHub | mmeza-developer/CVE-2018-0114 | 2021-11-06 |
| PoC in GitHub | Pandora-research/CVE-2018-0114-Exploit | 2022-09-26 |
Show 5 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | amr9k8/jwt-spoof-tool | 2023-03-16 |
| PoC in GitHub | z-bool/Venom-JWT | 2025-01-27 |
| PoC in GitHub | sealldeveloper/CVE-2018-0114-PoC | 2025-04-25 |
| PoC in GitHub | n0m-d/CVE-2018-0114-Go | 2025-08-14 |
| PoC in GitHub | fevra-dev/ClaimJumper | 2026-01-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-0114 is a high vulnerability (CVSS 7.5) in Cisco Node-jose, published January 4, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 42.7%, the 98th percentile. Fixed in node-jose 0.11.0.
References
tools.cisco.com/security/center/viewAlert.x?alertId=56326
github.com/zi0Black/POC-CVE-2018-0114
exploit-db.com/exploits/44324
securityfocus.com/bid/102445
nvd.nist.gov/vuln/detail/CVE-2018-0114
web.archive.org/web/20210124130907/http://www.securityfocus.com/bid/102445