web-token/jwt-library
Composer · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption | web-token/jwt-experimentalweb-token/jwt-library | Composer | Medium | Fix reported | |
| PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks | web-token/jwt-bundleweb-token/jwt-experimental | Composer | High | Fix reported | |
| PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle | web-token/jwt-frameworkweb-token/jwt-library | Composer | Medium | Fix reported | |
| PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service | web-token/jwt-frameworkweb-token/jwt-library | Composer | High | Fix reported |