Description
The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | jose-php | fixed in 2.2.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | gree/jose | < 2.2.1 | 2.2.1 | GHSA-xm5f-hc9r-76f3 |