firebase/php-jwt vulnerabilities

Latest firebase/php-jwt CVEs

Newest publication first

1. GHSA-h533-5v22-8vcp firebase/php-jwt: "None" Algorithm treated as valid on tokens

   Published 2024-05-15

   Unknown

   Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES3...

2. CVE-2021-46743 Firebase PHP-JWT key/algorithm type confusion

   Published 2022-03-29

   Critical·CVSS 9.1 EPSS 0.92% PoC

   In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.