Jwt

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:lcobucci:jwt:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorLcobucci (ca8a4a35-dc9d-56ef-9af9-eba5292e5e68)
ProductJwt (542afae6-1869-5dc0-95d4-36719d68655d)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:composer/lcobucci/jwt purl2cpe 2026-06-01 10:12:39.296075
pkg:github/lcobucci/jwt purl2cpe 2026-06-01 10:12:39.296078

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2021-41106 vulnerable 2026-06-08 05:35:19.753732 File reference keys leads to incorrect hashes on HMAC algorithms
MEDIUM (4.4)
JWT is a library to work with JSON Web Token and JSON Web Signature. Prior to versions 3.4.6, 4.0.4, and 4.1.5, users of HMAC-based algorithms (HS256, HS384, and HS512) combined with `Lcobucci\JWT\Signer\Key\LocalFileReference` as key are having their tokens issued/validated using the file path as hashing key - instead of the contents. The HMAC hashing functions take any string as input and, since users can issue and validate tokens, users are lead to believe that everything works properly. Versions 3.4.6, 4.0.4, and 4.1.5 have been patched to always load the file contents, deprecated the `Lcobucci\JWT\Signer\Key\LocalFileReference`, and suggest `Lcobucci\JWT\Signer\Key\InMemory` as the alternative. As a workaround, use `Lcobucci\JWT\Signer\Key\InMemory` instead of `Lcobucci\JWT\Signer\Key\LocalFileReference` to create the instances of one's keys.
Published: 2021-09-28T20:50:11.000Z
Updated: 2024-08-04T02:59:31.511Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.