CVE-2016-5431

The CVE concerns the PHP JOSE Library by Gree Inc. prior to version 2.2.1. The underlying issue is key confusion/algorithm substitution in the JWS component, which allows bypassing signature verification with crafted tokens. Affected software/version: PHP JOSE Library