What is GHSA-9gxv-x7rp-r2hc?

GHSA-9gxv-x7rp-r2hc is a security advisory published by GitHub Security Advisories with Critical severity. gree/jose - "None" Algorithm treated as valid in tokens

Why does GHSA-9gxv-x7rp-r2hc have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-9gxv-x7rp-r2hc?

GHSA-9gxv-x7rp-r2hc affects 1 product, including: composer/gree/jose:\u003c 2.2.1.

GHSA-9gxv-x7rp-r2hcCriticalDisclosed before NVD

gree/jose - "None" Algorithm treated as valid in tokens

Vendor

GitHub Security Advisories

Published

May 15, 2024

Last Modified

July 16, 2026

📋 Description

Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).

🎯 Affected products1

composer/gree/jose:< 2.2.1

🔗 References (5)

https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries
https://github.com/FriendsOfPHP/security-advisories/blob/master/gree/jose/2016-08-30.yaml
https://github.com/nov/jose-php/compare/2.2.0...2.2.1
https://github.com/advisories/GHSA-9gxv-x7rp-r2hc