GHSA-9gxv-x7rp-r2hc
gree/jose - "None" Algorithm treated as valid in tokens
GHSA-9gxv-x7rp-r2hc is a vulnerability with no CVSS score yet in gree/jose, published May 15, 2024. No source lists public exploit code. Fixed in gree/jose 2.2.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.2.1gree/jose +1 more
Description
Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).
Affected packages
What each source reports
GitHub AdvisoriesNo score
gree/jose - "None" Algorithm treated as valid in tokens
Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).
- Record
GHSA-9gxv-x7rp-r2hc- Weakness
- CWE-327, CWE-347
- Updated
- 2026-11-02
OSVNo score
gree/jose - "None" Algorithm treated as valid in tokens
Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).
- Record
GHSA-9gxv-x7rp-r2hc- Weakness
- CWE-327, CWE-347
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
github.com/FriendsOfPHP/security-advisories/blob/master/gree/jose/2016-08-30.yaml