Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

  1. Reconshell
  2. Vulnerabilities (CVE)
Filtered by vendor Google Subscribe
Filtered by product Firebase Php-jwt
Total 1 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-46743 1 Google 1 Firebase Php-jwt 2022-04-08 5.8 MEDIUM 9.1 CRITICAL
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself.