-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from two issues in the _verify method: 1) It auto-detected the algorithm from the unverified token header when $expected_alg wasn't provided, allowing attackers to force HMAC verification with a public key. 2) It used '===' for HMAC signature comparison instead of constant-time hash_equals. The patch added explicit algorithm checks (throwing errors for auto-detected HMAC) and implemented secure comparisons, confirming these were the vulnerable points.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gree/jose | composer | < 2.2.1 | 2.2.1 |
KEV Misses 88% of Exploited CVEs- Get the report