Improper verification of cryptographic signature in JSON Web Signatures - CVE-2025-65945

Vulnerability identifier: #VU121638

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-65945

CWE-ID: CWE-347

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to improper signature verification under specific conditions when using the HS256 algorithm within the jws.createVerify() function. A remote attacker can manipulate header or payload in the HMAC secret lookup routines and bypass authorization checks. 

JSON Web Signatures
watsonx.data
Voice Gateway
watsonx Orchestrate Developer Edition
Security QRadar EDR
watsonx Code Assistant On Prem
WatsonX BI Assistant
watsonx.data integration
Maximo Application Suite - Monitor Component
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Maximo Application Suite - Edge Data Collector
Developer Hub
IBM App Connect Enterprise
PowerVC
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Watson Discovery for IBM Cloud Pak for Data
Event Streams

Install updates from vendor's website.

JSON Web Signatures - addressed in versions 3.2.3, 4.0.1
Voice Gateway - addressed in versions 1.0.8.17, 1.0.8.18, 1.0.8.24, 1.0.8.29
watsonx Orchestrate Developer Edition - update to 2.3.0
Developer Hub - addressed in versions 1.7.4, 1.8.2
watsonx.data - update to 2.3.1
Security QRadar EDR - update to 3.12.24
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 4.3.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.1
watsonx Code Assistant On Prem - update to 5.3.0
WatsonX BI Assistant - update to 5.3
watsonx.data integration - update to 5.3.1
Maximo Application Suite - Monitor Component - addressed in versions 8.10.27, 8.11.25, 9.0.17, 9.1.7
Event Streams - update to 12.2.2
IBM App Connect Enterprise - addressed in versions 12.0.12.21, 13.0.6.0
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - update to 16.1.0.20
Maximo Application Suite - Edge Data Collector - update to 8.11.25

• https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e
• https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x

• Improper verification of cryptographic signature in node-jws
• Multiple vulnerabilities in Red Hat Developer Hub 1.8
• Multiple vulnerabilities in IBM App Connect Enterprise
• IBM Edge Data Collector update for jws-3.2.2.tgz
• IBM Maximo Application Suite - Monitor Component update for jws-3.2.2.tgz
• Multiple vulnerabilities in IBM Voice Gateway
• IBM PowerVC update for auth0/node-jws
• IBM Watson Discovery Cartridge update for auth0/node-jws
• Multiple vulnerabilities in IBM watsonx Code Assistant On Prem
• Multiple vulnerabilities in Red Hat Developer Hub 1.7
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM WatsonX BI Assistant for CP4D
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM watsonx.data integration
• Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition
• IBM watsonx.data update for auth0/node-jws