Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.7

php-jwt Uses Weak Encryption, Compromising Data

CVE-2025-45769 · published 1 year ago
Summary

The php-jwt library in version 6.11.0 uses weak encryption, which could allow an attacker to intercept and read sensitive data. This could lead to unauthorized access to sensitive information. Update to a version with stronger encryption to ensure data remains secure.

What to do
  • Update firebase php-jwt to version 7.0.0.
Affected software
Ecosystem VendorProductAffected versions
composer firebase php-jwt < 7.0.0
Fix: upgrade to 7.0.0
– google firebase_php-jwt <= 6.11.0
cpe:2.3:a:google:firebase_php-jwt:*:*:*:*:*:*:*:*
Original advisory text
php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispu...
php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-326Inadequate Encryption Strength
Timeline
Published31 Jul 2025
Updated26 Oct 2026
First seen6 Mar 2026
Sources
CVE-2025-45769 · NVD
GHSA-2x45-7fc3-mxwq · GHSA
CVE-2025-45769 · OSV
Track software like this
Free during beta