Skip to content
OpenAdvisories

Package · Packagist

web-token/jwt-framework

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High —
    GHSA-jc38-x7x8-2xc8

    PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

    ## Summary `JWSVerifier::getAlgorithm()` in `src/Library/Signature/JWSVerifier.php` (line 144) merges protected and unprotected headers using PHP's spread operator: ```php $completeHeader = [...$signature->getProtectedHeader(), ...$signature->getHeader()]; ``…

    web-token/jwt-library web-token/jwt-experimental web-token/jwt-framework web-token/jwt-bundle Packagist
  • High —
    GHSA-3prj-6hqw-cm82

    PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service

    ### Impact When a JWE uses a password-based key-encryption algorithm (`PBES2-HS256+A128KW`, `PBES2-HS384+A192KW`, `PBES2-HS512+A256KW`), `PBES2AESKW::unwrapKey()` reads the `p2c` (PBKDF2 iteration count) parameter directly from the attacker-controlled JOSE he…

    web-token/jwt-library web-token/jwt-framework Packagist