Skip to content
OpenAdvisories

Package · Packagist

firebase/php-jwt

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.5
    CVE-2025-45769

    php-jwt contains weak encryption

    php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and oth…

    firebase/php-jwt Packagist
  • Critical —
    GHSA-h533-5v22-8vcp

    firebase/php-jwt: "None" Algorithm treated as valid on tokens

    Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS3…

    firebase/php-jwt Packagist
  • Critical 9.1
    CVE-2021-46743

    Firebase PHP-JWT key/algorithm type confusion

    In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. N…

    firebase/php-jwt Packagist