CVE-2025-45769

php-jwt v6.11.0 was discovered to contain weak encryption

Medium · published July 31, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00148 · 3.7th percentile
Published
2025-07-31T00:00Z
EPSS history
Timeline
  • 31 JUL 00:00Z
    php-jwt v6.11.0 was discovered to contain weak encryption
    cvelistv5