Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

googleapis/php-jwt

              main @ b374a5d
            

Fixes

CVEs

CRITICAL

Peak severity

86.7%

Coverage

Highlights

Auth Bypass: 10 prior fixes. Scrutinize any change in this area.

src/JWT.php: most-fixed (13 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers can bypass signature verification entirely by exploiting structural issues like weak algorithm fallback, null/empty keys, or missing Key ID ('kid') parameter validations. This risk led to the strict encapsulation of keys in designated Key objects.

Auth Bypass: Incorrect return-value parsing of PHP's openssl_verify function can lead to total authentication bypass. Because openssl_verify returns 1 for success, 0 for failure, and -1 for internal errors, failing to verify an exact status of 1 allows error states to be treated as valid signatures.

Cryptographic Issues: Insufficent validation of minimum key lengths across RSA, HMAC, and ECDSA keys allows the use of weak or truncated keys, exposing the signature verification process to spoofing and cryptographic attacks.