Skip to content
OpenAdvisories

Package · Packagist

namshi/jose

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical —
    GHSA-4rr6-gf59-ggw5

    namshi/jose - Verification bypass

    Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS3…

    namshi/jose Packagist
  • High —
    GHSA-hxhc-wmg8-xrqf

    namshi/jose insecure JSON Web Signatures (JWS)

    namshi/jose allows the acceptance of unsecure JSON Web Signatures (JWS) by default. The vulnerability arises from the $allowUnsecure flag, which, when set to true during the loading of JWSes, permits tokens signed with 'none' algorithms to be processed. This …

    namshi/jose Packagist