{"id":"GHSA-8xf4-w7qw-pjjw","aliases":["CVE-2021-46743"],"title":"Firebase PHP-JWT key/algorithm type confusion","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"CRITICAL","description":"In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself.","severity":"critical","score":9.1,"published":"2022-03-30T00:00:27.000Z","modified":"2023-11-08T04:07:27.311Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"firebase/php-jwt","sources":[{"name":"OSV · GHSA-8xf4-w7qw-pjjw","url":"https://osv.dev/vulnerability/GHSA-8xf4-w7qw-pjjw"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.0.0"}],"type":"ECOSYSTEM"}],"versions":["1.0.0","2.0.0","v2.1.0","v2.2.0","v3.0.0","v4.0.0","v5.0.0","v5.1.0","v5.2.0","v5.2.1","v5.3.0","v5.4.0","v5.5.0","v5.5.1"],"fixed":["6.0.0"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-46743","https://github.com/firebase/php-jwt/issues/351","https://github.com/FriendsOfPHP/security-advisories/blob/master/firebase/php-jwt/CVE-2021-46743.yaml","https://github.com/firebase/php-jwt","https://github.com/firebase/php-jwt/releases/tag/v6.0.0"],"sources":[{"name":"OSV","id":"GHSA-8xf4-w7qw-pjjw","modified":"2023-11-08T04:07:27.311791Z","url":"https://osv.dev/vulnerability/GHSA-8xf4-w7qw-pjjw"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1}],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T11:55:31.891Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}