GHSA-h533-5v22-8vcp: 
PHP vulnerability analysis and mitigation

A critical vulnerability was discovered in several JSON Web Token (JWT) libraries, including firebase/php-jwt, affecting versions prior to 2.0.0. The vulnerability allowed attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512). This security issue was particularly concerning for implementations using JWT for authentication purposes (GitHub Advisory, Auth0 Blog).

The vulnerability stemmed from how JWT libraries handled the algorithm ('alg') field in the token header. The issue allowed attackers to control which method was used to verify the signature, leading to two main attack vectors: the 'none' algorithm attack and the algorithm confusion attack between RSA and HMAC. In the RSA/HMAC confusion attack, if a server was expecting a token signed with RSA but received one signed with HMAC, it would treat the public key as an HMAC secret key (Auth0 Blog).

The vulnerability could allow attackers to forge valid tokens and bypass authentication mechanisms. Since public keys are typically publicly available, attackers could use these keys to create forged tokens that would pass verification, potentially gaining unauthorized access to protected resources (Auth0 Blog).

The vulnerability was highly exploitable as it only required knowledge of the public key used for verification. Attackers could forge tokens by signing them using the public key as an HMAC key, effectively bypassing the intended RSA verification process (Auth0 Blog).

The issue was patched in version 2.0.0 of firebase/php-jwt. The fix involved updating the decode() function to require explicit specification of allowed algorithms when verifying tokens. Users were advised to upgrade to version 2.0.0 or later to address this vulnerability (GitHub Commit).