CVE-2021-46743

CVE-2021-46743 : In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue occurs via the kid header when multiple key types are loaded in a key ring, allowing an attacker to forge tokens that validate under the incorrect key. The description notes this may reflect unsafe usage of the PHP-JW...

CVE-2025-45769

The php-jwt library (version 6.11.0 ) was found to contain weak encryption . While the issue was disputed because key lengths are typically set by the application rather than the library, the vulnerability is addressed in certain distributions. For instance, TuxCare provided a rebuilt version fix...