CVE-2018-1000025

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or fro...

CVE-2018-1000025: Incorrect Permission Assignment for Critical Resource

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or fro...

PT-2018-9216

Name of the Vulnerable Software and Affected Versions: Firebase Admin SDK for PHP versions 3.2.0 through 3.8.0 Description: The issue is related to an Incorrect Access Control vulnerability in the src/Firebase/Auth/IdTokenVerifier.php file, which does not verify token signatures. This can result ...