Google Firebase PHP-Jwt vulnerabilities

2 CVEs affecting Google Firebase PHP-Jwt, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-45769, published 2025-07-31.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-46743, published 2022-03-29. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an…
• CVE-2025-45769, published 2025-07-31. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute…