-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper algorithm validation during JWT verification. The library's JWS::verify method likely relied on the 'alg' header from the untrusted token payload to determine the verification method, rather than enforcing the expected algorithm. This allowed attackers to forge tokens by specifying HMAC algorithms (like HS256) and using the public RSA/ECDSA key as an HMAC secret. The high confidence comes from the documented vulnerability pattern in JWT libraries and the patched version (2.2.0) indicating a fix in verification logic.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| namshi/jose | composer | < 2.2.0 | 2.2.0 |
Ongoing coverage of React2Shell