Vulnerability DatabaseWS-2015-0045
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
WS-2015-0045
Published:May 14, 2026
Updated:May 14, 2026
jsonwebtoken before v4.2.0, PyJWT before 1.0.0, and PHP jose before 2.2.0 allows bypass verification step. An attacker may specify which method to use in order to verify the signature.
Affected Packages
namshi/jose (PHP):
Affected version(s) >=dev-readme-fix <1.0.0-rc1
Fix Suggestion:
Update to version 1.0.0-rc1
namshi/jose (PHP):
Affected version(s) =2.0.1 <2.0.2
Fix Suggestion:
Update to version 2.0.2
namshi/jose (PHP):
Affected version(s) =dev-php5.5-essential <6.0.0
Fix Suggestion:
Update to version 6.0.0
namshi/jose (PHP):
Affected version(s) =dev-disabling-none-by-default <dev-fix-hhvm-JWSTest
Fix Suggestion:
Update to version dev-fix-hhvm-JWSTest
namshi/jose (PHP):
Affected version(s) =dev-fix-hmac-timing-attacks <dev-fix-ian-int-casting
Fix Suggestion:
Update to version dev-fix-ian-int-casting
namshi/jose (PHP):
Affected version(s) >=1.0.1 <dev-phpseclib2
Fix Suggestion:
Update to version dev-phpseclib2
namshi/jose (PHP):
Affected version(s) >=2.0.3 <2.2.0
Fix Suggestion:
Update to version 2.2.0
pyjwt (PYTHON):
Affected version(s) >=0.1.1 <1.0.0
Fix Suggestion:
Update to version 1.0.0
Related Resources (1)
https://github.com/FriendsOfPHP/security-advisories/commit/ff2c5719d50cf9c926695d062fc9200fe99a7768
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.9
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE