Skip to content
OpenAdvisories

Package · Packagist

web-token/jwt-experimental

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High —
    GHSA-jc38-x7x8-2xc8

    PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

    ## Summary `JWSVerifier::getAlgorithm()` in `src/Library/Signature/JWSVerifier.php` (line 144) merges protected and unprotected headers using PHP's spread operator: ```php $completeHeader = [...$signature->getProtectedHeader(), ...$signature->getHeader()]; ``…

    web-token/jwt-library web-token/jwt-experimental web-token/jwt-framework web-token/jwt-bundle Packagist
  • Medium —
    GHSA-6vvh-pxr4-25r7

    PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption

    ### Impact The experimental `Chacha20Poly1305` key-encryption algorithm generates the 16-byte Poly1305 authentication tag during `encryptKey()` but **discards it**: the tag is never written to the header and therefore never reaches the wire. On the receiving …

    web-token/jwt-library web-token/jwt-experimental Packagist