Skip to content

firebase/php-jwt: "None" Algorithm treated as valid on tokens

Critical severity GitHub Reviewed Published May 15, 2024 to the GitHub Advisory Database • Updated May 15, 2024

Package

composer firebase/php-jwt (Composer)

Affected versions

< 2.0.0

Patched versions

2.0.0

Description

Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).

References

Published to the GitHub Advisory Database May 15, 2024
Reviewed May 15, 2024
Last updated May 15, 2024

Severity

Critical

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-h533-5v22-8vcp

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.