Package · Packagist

web-token/jwt-experimental

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High —

GHSA-jc38-x7x8-2xc8

PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

## Summary `JWSVerifier::getAlgorithm()` in `src/Library/Signature/JWSVerifier.php` (line 144) merges protected and unprotected headers using PHP's spread operator: ```php $completeHeader = [...$signature->getProtectedHeader(), ...$signature->getHeader()]; ``…

web-token/jwt-library web-token/jwt-framework web-token/jwt-experimental web-token/jwt-bundle Packagist

Jun 18, 2026