Skip to content
OpenAdvisories

Package · Packagist

gree/jose

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical —
    GHSA-9gxv-x7rp-r2hc

    gree/jose - "None" Algorithm treated as valid in tokens

    Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS3…

    gree/jose Packagist
  • High 7.5
    CVE-2016-5431

    PHP JOSE Library by Gree Inc. Uses a Broken or Risky Cryptographic Algorithm

    The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens.

    gree/jose Packagist