GHSA-8xf4-w7qw-pjjw
Firebase PHP-JWT key/algorithm type confusion
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | firebase/php-jwt | < 6.0.0 | 6.0.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself.
References
External links from the advisory. They lead to third-party sites.