CVE-2024-25191: Zihanggao PHP-Jwt

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.

Affected products

• Zihanggao PHP-Jwt: version 1.0.0 only

Published 2024-02-08. Last modified 2026-06-17.