CVE-2025-45769: php-jwt contains weak encryption

medium Affects firebase/php-jwt. Feed 2026.10.29.3, updated 2026-10-29; published 2025-07-31; advisory modified 2026-09-10.

php-jwt contains weak encryption

Package: firebase/php-jwt Composer
Affected versions: <7.0.0
Fixed in: 7.0.0
Severity: medium CVSS 6.5
Exploitation: not on CISA KEV · EPSS 0% (4.0th percentile)
Published: 2025-07-31
Source: osv.dev

References

CWE-326

NVD record firebase/php-jwt advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2021-46743 critical Firebase PHP-JWT key/algorithm type confusion same package: firebase/php-jwt
2015-04-02 unknown Critical vulnerabilities in JSON Web Token libraries same package: firebase/php-jwt
GHSA-h533-5v22-8vcp critical firebase/php-jwt: "None" Algorithm treated as valid on tokens same package: firebase/php-jwt
CVE-2018-19784 high Weak Cryptography in PHP-Proxy same weakness: CWE-326
CVE-2012-6707 high WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it e same weakness: CWE-326
CVE-2017-7888 critical Dolibarr ERP and CRM Insecure Encryption same weakness: CWE-326