Packagist/web-token/jwt-experimental: medium
PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 4.1.6 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-6vvh-pxr4-25r7
- https://github.com/web-token/jwt-framework/security/advisories/GHSA-6vvh-pxr4-25r7
- https://github.com/FriendsOfPHP/security-advisories/blob/master/web-token/jwt-library/GHSA-6vvh-pxr4-25r7.yaml
- https://github.com/web-token/jwt-framework
published · modified · JSON