{"action":"Upgrade gree/jose to 2.2.1 or later.","affected":[{"fixed":"2.2.1","introduced":"0"}],"component":"gree/jose","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["2.2.1"],"ghsa_id":"GHSA-9gxv-x7rp-r2hc","id":"tcs_01M5KF01SMGR3T3XK8TPB80YA5","modified_at":"2026-07-16T19:00:22.053841153Z","published_at":"2024-05-15T21:47:39Z","references":["https://osv.dev/vulnerability/GHSA-9gxv-x7rp-r2hc","https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries","https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries","https://github.com/FriendsOfPHP/security-advisories/blob/master/gree/jose/2016-08-30.yaml","https://github.com/nov/jose-php","https://github.com/nov/jose-php/compare/2.2.0...2.2.1"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-9gxv-x7rp-r2hc","url":"https://osv.dev/vulnerability/GHSA-9gxv-x7rp-r2hc"}],"summary":"gree/jose - \"None\" Algorithm treated as valid in tokens"}