CVE-2016-5430: Jose-PHP Project Jose-PHP

Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days.

The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).

Affected products

• Jose-PHP Project Jose-PHP: before 2.2.1 (fixed in 2.2.1)

Published 2016-09-03. Last modified 2026-06-17.