{"id":"GHSA-9gxv-x7rp-r2hc","aliases":[],"status":"published","title":"gree/jose - \"None\" Algorithm treated as valid in tokens","description":"Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-327","CWE-347"],"published":"2024-05-15T21:47:39Z","modified":"2026-07-16T19:00:22Z","fixes":[{"ecosystem":"Packagist","package":"gree/jose","fixed_in":["2.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"gree/jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"gree/jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1"}]}],"versions":["0.1.0","0.1.1","0.1.3","0.1.4","0.1.5","1.0.0","1.0.1","2.0.0","2.0.1","2.1.0","2.2.0"]}],"references":[{"url":"https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries","tags":["web"]},{"url":"https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/gree/jose/2016-08-30.yaml","tags":["web"]},{"url":"https://github.com/nov/jose-php/compare/2.2.0...2.2.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9gxv-x7rp-r2hc"},{"url":"https://github.com/nov/jose-php","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-9gxv-x7rp-r2hc","title":"gree/jose - \"None\" Algorithm treated as valid in tokens","description":"Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).","status":"published","published":"2024-05-15T21:47:39Z","modified":"2026-07-16T18:46:46Z","cwes":["CWE-327","CWE-347"],"updated_at":"2026-11-02T14:40:44.915484Z"}],"osv":[{"id":"GHSA-9gxv-x7rp-r2hc","title":"gree/jose - \"None\" Algorithm treated as valid in tokens","description":"Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).","status":"published","published":"2024-05-15T21:47:39Z","modified":"2026-07-16T19:00:22.053841153Z","cwes":["CWE-327","CWE-347"],"updated_at":"2026-11-02T15:46:43.875515Z"}]}}