Packagist/firebase/php-jwt: critical
firebase/php-jwt: "None" Algorithm treated as valid on tokens
Action: Upgrade firebase/php-jwt to 2.0.0 or later.
composer require firebase/php-jwt:2.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.0 | - |
Fixed versions
| 2.0.0 |
Sources
- osv: GHSA-h533-5v22-8vcp
- https://github.com/firebase/php-jwt/commit/b2c2be6a45fda769c8c2ffe5ec4259a9d1e46e5b
- https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
- https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries
- https://github.com/FriendsOfPHP/security-advisories/blob/master/firebase/php-jwt/2015-04-02.yaml
- https://github.com/firebase/php-jwt
published · modified · JSON