Medium severity6.5NVD Advisory· Published Jul 31, 2025· Updated Jun 17, 2026
CVE-2025-45769
CVE-2025-45769
Description
php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
firebase/php-jwtPackagist | < 7.0.0 | 7.0.0 |
Affected products
6- osv-coords5 versionspkg:apk/chainguard/zabbix-web-nginx-pgsql-7.0pkg:apk/chainguard/zabbix-web-nginx-pgsql-7.4pkg:apk/chainguard/zabbix-web-nginx-pgsql-fips-7.0pkg:apk/chainguard/zabbix-web-nginx-pgsql-fips-7.4pkg:composer/firebase/php-jwt
< 7.0.23-r1+ 4 more
- (no CPE)range: < 7.0.23-r1
- (no CPE)range: < 7.4.7-r1
- (no CPE)range: < 7.0.23-r1
- (no CPE)range: < 7.4.7-r1
- (no CPE)range: < 7.0.0
Patches
Vulnerability mechanics
References
10- gist.github.com/ZupeiNie/83756316c4c24fe97a50176a92608db3nvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-2x45-7fc3-mxwqnvdADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-45769ghsaADVISORY
- github.com/firebase/php-jwt/commit/6b80341bf57838ea2d011487917337901cd71576ghsaWEB
- github.com/firebase/php-jwt/issues/611ghsaWEB
- github.com/firebase/php-jwt/issues/618ghsaWEB
- github.com/firebase/php-jwt/issues/620nvdWEB
- github.com/firebase/php-jwt/pull/613nvdWEB
- github.com/firebase/php-jwt/releases/tag/v7.0.0nvdWEB
- github.com/github/advisory-database/pull/6954nvdWEB
News mentions
0No linked articles in our index yet.