Skip to content
OpenAdvisories

Package · Packagist

firebase/php-jwt

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical —
    GHSA-h533-5v22-8vcp

    firebase/php-jwt: "None" Algorithm treated as valid on tokens

    Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS3…

    firebase/php-jwt Packagist
  • Critical 9.1
    CVE-2021-46743

    Firebase PHP-JWT key/algorithm type confusion

    In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. N…

    firebase/php-jwt Packagist