jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() in ledgerline 1.0.0

1. Exploited vulnerability detected

   DoneSecure22 Oct 2026, 13:06 UTC

   CVE-2022-23540 in jsonwebtoken 8.5.1, matched from the SBOM against OSV and CISA KEV 2026.10.21. Exploitation signal: simulated for this exercise.

   PipelineDetection job
2. Case opened, clocks started

   DonePlan22 Oct 2026, 13:06 UTC

   Issue created from the case template with labels, due dates and the fact sheet.

   PipelineIssue #1
3. Qualification proposed

   DoneSecure22 Oct 2026, 13:08 UTC

   Proposed reportable. This is a drill. The SBOM records jsonwebtoken 8.5.1 in ledgerline 1.0.0, and the advisory for CVE-2022-23540 lists versions up to 8.5.1 as affected, so the vulnerable component and version are contained in the product. For the exercise, the recorded scenario treats active exploitation against Ledgerline share links as the evidence. That exploitation is simulated, and the CVE is not listed in CISA KEV (catalog version 2026.10.21). Awareness is recorded at 2026-10-22T13:06:42.022Z. The Member States where the product is made available are not recorded (gap), so the EU availability check is open until the lead fills it in. Nothing from this drill is sent to an authority.

   ai-article-14-triage-gitlab-ai-hackathonProposal note
4. Qualification confirmed

   DoneGovern22 Oct 2026, 13:10 UTC

   Decision: reportable.

   ChinorabDecision note
5. Fix merge request opened

   DoneCreate

   Upgrade of jsonwebtoken to 9.0.0 with a regression test.

   ChinorabMR !9
6. Pipeline verified the fix

   DoneVerify22 Oct 2026, 13:24 UTC

   4 merge request pipeline(s); 2 failed and repaired; last success. Unit, integration, SAST, secret detection and dependency scanning.

   Pipeline fix flow and pipelinePipeline 2976735884
7. Fix merged

   DonePackage22 Oct 2026, 13:35 UTC

   The fix reaches main: image build, SBOM, container scanning, staging deployment and smoke tests run on their own.

   ChinorabMR !9
8. Production approved and deployed

   DoneRelease22 Oct 2026, 13:58 UTC

   Deployed to Cloud Run production, then checked by the monitor job. The final report clock starts here.

   ChinorabDeployment job
9. Security release published

   DoneRelease22 Oct 2026, 14:00 UTC

   Release v1.0.1 with notes written from the fix merge request.

   Pipeline and release notes flowv1.0.1
10. Report drafts prepared

    DoneGovern22 Oct 2026, 13:12 UTC

    Three drafts rendered from the fact sheet, narrative fields proposed from recorded facts, gaps left for the lead.

    CRA report flowMR !8
11. Drafts approved

    DoneGovern22 Oct 2026, 14:21 UTC

    Merging the reports merge request is the human approval of the drafts.

    ChinorabMR !8
12. Reports submitted manually

    DoneGovern22 Oct 2026, 14:28 UTC

    3 of 3 submissions recorded in the drill; nothing was sent.

    ChinorabIssue #1

Audit log

Every action on this case by a flow, the pipeline or a person, in UTC. Source: wiki page cases/A14-20261022-1/audit-log.