CVE-2021-46743
Critical
Description
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Google Firebase Php-jwt
PublishedMar 29, 2022
First seenMar 29, 2022
How to fix
Update
- google firebase_php-jwt6.0.0 or later
- firebase/php-jwt6.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google firebase_php-jwt | v < 6.0.0 | 6.0.0 |
| firebase/php-jwtPackagist | v < 6.0.0 | 6.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.