Skip to content

gree/jose - "None" Algorithm treated as valid in tokens

Critical severity GitHub Reviewed Published May 15, 2024 to the GitHub Advisory Database

Package

composer gree/jose (Composer)

Affected versions

<= 2.2.0

Patched versions

None

Description

Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).

References

Published to the GitHub Advisory Database May 15, 2024
Reviewed May 15, 2024

Severity

Critical

Weaknesses

No CWEs

CVE ID

No known CVE

GHSA ID

GHSA-9gxv-x7rp-r2hc

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.