---
title: "GHSA-h533-5v22-8vcp: firebase/php-jwt: \"None\" Algorithm treated as valid on tokens"
url: https://erroneo.us/security/ghsa/GHSA-h533-5v22-8vcp/
description: "GHSA-h533-5v22-8vcp (critical, Composer (PHP)): firebase/php-jwt: \"None\" Algorithm treated as valid on tokens. Several widely-used JSON Web Token (JWT)…"
type: advisory
section: "Security Digest"
date_published: 2024-05-15
date_modified: 2024-05-15
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-h533-5v22-8vcp"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-h533-5v22-8vcp: firebase/php-jwt: "None" Algorithm treated as valid on tokens

## Affected packages

- Composer (PHP) `firebase/php-jwt` < 2.0.0 → fixed: 2.0.0

## Details

Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).

## Sources

- [GitHub Advisory GHSA-h533-5v22-8vcp](https://github.com/advisories/GHSA-h533-5v22-8vcp)
- [github.com](https://github.com/firebase/php-jwt/commit/b2c2be6a45fda769c8c2ffe5ec4259a9d1e46e5b)
- [auth0.com](https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries)
- [auth0.com](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries)
- [github.com](https://github.com/FriendsOfPHP/security-advisories/blob/master/firebase/php-jwt/2015-04-02.yaml)

---
Source page: https://erroneo.us/security/ghsa/GHSA-h533-5v22-8vcp/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt