CVE-2025-45769: Weak Encryption in firebase/php-jwt Package
Summary
CVE-2025-45769: php-jwt contains weak encryption. Affects firebase/php-jwt versions < 7.0.0. Fixed in 7.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The firebase/php-jwt package is a popular library used for encoding and decoding JSON Web Tokens (JWT) in PHP applications. It provides a simple and secure way to handle authentication and authorization in web applications. However, the package has been found to contain weak encryption mechanisms, which can expose applications to security risks.
Vulnerability Detail
The vulnerability identified as CVE-2025-45769 in the firebase/php-jwt package stems from the use of weak encryption algorithms in version 6.11.0. This weakness can allow attackers to exploit the encryption methods, potentially leading to unauthorized access to sensitive information. The vulnerability is classified under CWE-326, indicating issues related to inadequate encryption strength. The ramifications of this vulnerability can be severe, as it may compromise the integrity and confidentiality of the data being transmitted.
How To Fix
Minimum fixed version
7.0.0
This is the first release that contains the fix.
composer require firebase/php-jwt:7.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing additional security measures such as using stronger encryption algorithms manually or switching to an alternative library that provides robust encryption for JWT handling.
Conclusion
The CVE-2025-45769 vulnerability in the firebase/php-jwt package highlights the importance of using strong encryption methods in software development. It is crucial for developers to keep their dependencies updated and to monitor for vulnerabilities to ensure the security of their applications.
See every vulnerability recorded for firebase/php-jwt →
FAQ
CVE-2025-45769 is a vulnerability in the firebase/php-jwt package that involves weak encryption methods, potentially compromising the security of applications using this library.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability may lead to unauthorized access to sensitive data, putting your application and its users at risk.
Yes, the vulnerability has been patched in version 7.0.0 of the firebase/php-jwt package. Updating to this version will resolve the issue.
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for firebase/php-jwt.
