GitHub Advisoryadvisory · Packagist

GHSA-9gxv-x7rp-r2hc gree/jose - "None" Algorithm treated as valid in tokens

CRITICAL Published 2024-05-15 Modified 2026-07-16 Official page ↗
Ecosystem
Packagist
Packages
gree/jose
Severity
Critical
Weaknesses
CWE-327, CWE-347
Reviewed
2024-05-15

Affected packages

• Packagist gree/jose: < 2.2.1 → fixed in 2.2.1

Description

Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).

Related

Weakness · CWE (2)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References