CVE-2021-46743: Key/algorithm type confusion
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/firebase/php-jwtto a version that resolves this vulnerability.Fixed in 6.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2021-46743?
CVE-2021-46743 has a medium severity rating due to the potential for token forgery.
How do I fix CVE-2021-46743?
To fix CVE-2021-46743, update your Firebase PHP-JWT library to version 6.0.0 or later.
What type of vulnerability is CVE-2021-46743?
CVE-2021-46743 is an algorithm-confusion vulnerability that may allow an attacker to exploit key mismanagement.
Which software is affected by CVE-2021-46743?
CVE-2021-46743 affects versions of Firebase PHP-JWT prior to 6.0.0.
What can an attacker do exploiting CVE-2021-46743?
Exploiting CVE-2021-46743 allows an attacker to forge tokens that could validate incorrectly under a different key.