Description (CNA)
The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / jose-php | affected fixed in 2.2.1 |
CWE
CWE-327
References
ADP enrichment
No English description supplied.