GHSA-h533-5v22-8vcp
firebase/php-jwt: "None" Algorithm treated as valid on tokens
Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).
What each source reports
GitHub AdvisoriesNo score
firebase/php-jwt: "None" Algorithm treated as valid on tokens
Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).
- Record
GHSA-h533-5v22-8vcp- Updated
- 2026-11-02
OSVNo score
firebase/php-jwt: "None" Algorithm treated as valid on tokens
Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).
- Record
GHSA-h533-5v22-8vcp- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firebase/php-jwtPackagist | before 2.0.0 | 2.0.0 |
firebase/php-jwtPackagist | before 2.0.0, plus listed versions 1.0.0 | 2.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-h533-5v22-8vcp is a vulnerability with no CVSS score yet in firebase/php-jwt, published May 15, 2024. No source lists public exploit code. Fixed in firebase/php-jwt 2.0.0.
References
github.com/firebase/php-jwt/commit/b2c2be6a45fda769c8c2ffe5ec4259a9d1e46e5b
auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries