CVE-2025-45769
php-jwt contains weak encryption
php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
- Record
CVE-2025-45769- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
EUVDEUVD-2025-23305
php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
- Record
EUVD-2025-23305- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2x45-7fc3-mxwq
php-jwt contains weak encryption
php-jwt v6.11.0 was discovered to contain weak encryption.
- Record
GHSA-2x45-7fc3-mxwq- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
NVD
php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
- Record
CVE-2025-45769- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
OSV
php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
- Record
CVE-2025-45769- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-2x45-7fc3-mxwq
php-jwt contains weak encryption
php-jwt v6.11.0 was discovered to contain weak encryption.
- Record
GHSA-2x45-7fc3-mxwq- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
OSVCLSA-2026-1769734644 No score
TuxCare security update for firebase/php-jwt (1 CVE)
TuxCare rebuilt firebase/php-jwt to address 1 CVE. Fixed in 6.11.1-p2+tuxcare.
- Record
CLSA-2026-1769734644- Updated
- 2026-11-02
OSVCLSA-2026-1788348158 No score
TuxCare security update for firebase/php-jwt (1 CVE)
TuxCare rebuilt firebase/php-jwt to address 1 CVE. Fixed in v5.5.1-p1+tuxcare.
- Record
CLSA-2026-1788348158- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firebase/php-jwtPackagist |
before 7.0.0 | 7.0.0 |
firebase/php-jwtTuxCare:Packagist |
6.11.1 up to 6.11.1-p2+tuxcare, plus listed versions 6.11.1-p1+tuxcare |
6.11.1-p2+tuxcare |
firebase/php-jwtTuxCare:Packagist |
v5.5.1 up to v5.5.1-p1+tuxcare | v5.5.1-p1+tuxcare |
firebase/php-jwtPackagist |
before 7.0.0, plus listed versions 1.0.02.0.0v2.1.0v2.2.0v3.0.0 Show 29 moreShow lessv4.0.0v5.0.0v5.1.0v5.2.0v5.2.1v5.3.0v5.4.0v5.5.0v5.5.1v6.0.0v6.1.0v6.1.1v6.1.2v6.10.0v6.10.1v6.10.2v6.11.0v6.11.1v6.2.0v6.3.0v6.3.1v6.3.2v6.4.0v6.5.0v6.6.0v6.7.0v6.8.0v6.8.1v6.9.0 |
7.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-45769 is a medium vulnerability (CVSS 6.5) in Google Firebase Php-jwt, published July 31, 2025. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in firebase/php-jwt 7.0.0.
References
github.com/firebase/php-jwt
gist.github.com/ZupeiNie/83756316c4c24fe97a50176a92608db3
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2025-45769