---
title: "GHSA-9gxv-x7rp-r2hc: gree/jose - \"None\" Algorithm treated as valid in tokens"
url: https://erroneo.us/security/ghsa/GHSA-9gxv-x7rp-r2hc/
description: "GHSA-9gxv-x7rp-r2hc (critical, Composer (PHP)): gree/jose - \"None\" Algorithm treated as valid in tokens. Several widely-used JSON Web Token (JWT) libraries…"
type: advisory
section: "Security Digest"
date_published: 2024-05-15
date_modified: 2026-07-16
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-9gxv-x7rp-r2hc"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-9gxv-x7rp-r2hc: gree/jose - "None" Algorithm treated as valid in tokens

## Affected packages

- Composer (PHP) `gree/jose` < 2.2.1 → fixed: 2.2.1

## Details

Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).

## Sources

- [GitHub Advisory GHSA-9gxv-x7rp-r2hc](https://github.com/advisories/GHSA-9gxv-x7rp-r2hc)
- [auth0.com](https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries)
- [auth0.com](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries)
- [github.com](https://github.com/FriendsOfPHP/security-advisories/blob/master/gree/jose/2016-08-30.yaml)
- [github.com](https://github.com/nov/jose-php/compare/2.2.0...2.2.1)

---
Source page: https://erroneo.us/security/ghsa/GHSA-9gxv-x7rp-r2hc/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt