Improper Verification of Cryptographic Signature Affecting web-token/jwt-library package, versions <3.4.10>=4.0.0, <4.0.7>=4.1.0, <4.1.7
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-WEBTOKENJWTLIBRARY-17420437
- published23 Jun 2026
- disclosed17 Jun 2026
- creditPapadope
Introduced: 17 Jun 2026
CVE NOT AVAILABLE CWE-347 (opens in a new tab)How to fix?
Upgrade web-token/jwt-library to version 3.4.10, 4.0.7, 4.1.7 or higher.
Overview
Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via header merging in JWSVerifier::getAlgorithm() and JWEDecrypter. An attacker can bypass protected header validation by placing conflicting alg or enc values in unprotected headers, which override the integrity-protected values during actual verification or decryption due to last-wins merge behavior. This creates a mismatch between the header values checked by HeaderCheckerManager and the values later used for cryptographic processing.