Validation Bypass

firebase/php-jwt is vulnerable to validation bypass. The vulnerability exists in decode and verify functions in JWT.php because the token validations are not properly handled when multiple keys are loaded in a key ring which allows an attacker to bypass server-side validations...

Design/Logic Flaw

JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens...