lcobucci/jwt

Version	Released
`5.6.0` minor	Oct 17, 2025
`5.4.3` patch	Feb 06, 2025
`5.5.0` minor	Jan 26, 2025
`5.4.2` patch	Nov 07, 2024
`5.4.1` patch	Nov 06, 2024
`5.4.0` minor	Oct 08, 2024
`5.3.0` minor	Apr 11, 2024
`5.2.0` minor	Nov 20, 2023
`5.1.0` minor	Oct 31, 2023
`5.0.0` major	Feb 25, 2023
`4.3.0` minor	Jan 02, 2023
`4.2.1` patch	Aug 19, 2022
`4.2.0` minor	Aug 19, 2022
`4.1.5` patch	Sep 28, 2021
`4.0.4` patch	Sep 28, 2021
`3.4.6` patch	Sep 28, 2021
`4.1.4` patch 1 CVE	Mar 23, 2021
`4.0.3` patch 1 CVE	Mar 23, 2021
`4.1.3` patch 1 CVE	Mar 19, 2021
`4.0.2` patch 1 CVE	Mar 19, 2021
`4.1.2` patch 1 CVE	Feb 19, 2021
`4.1.1` patch 1 CVE	Feb 16, 2021
`3.4.5` patch 1 CVE	Feb 16, 2021
`3.4.4` patch 1 CVE	Feb 10, 2021
`4.1.0` minor 1 CVE	Jan 28, 2021
`4.0.1` patch 1 CVE	Jan 28, 2021
`3.4.3` patch 1 CVE	Jan 27, 2021
`3.4.2` patch 1 CVE	Dec 03, 2020
`3.4.1` patch 1 CVE	Nov 27, 2020
`4.0.0` major 1 CVE	Nov 25, 2020
`3.4.0` minor 1 CVE	Nov 25, 2020
`4.0.0-beta1` pre	Nov 20, 2020
`3.3.3` patch	Aug 20, 2020
`3.3.2` patch	May 22, 2020
`3.3.1` patch	May 24, 2019
`3.3.0` minor	May 22, 2019
`4.0.0-alpha3` pre	Apr 16, 2019
`4.0.0-alpha2` pre	Feb 05, 2019
`3.2.5` patch	Nov 11, 2018
`3.2.4` patch	Aug 03, 2018
`3.2.3` patch	Jul 29, 2018
`3.2.2` patch	Sep 01, 2017
`4.0.0-alpha1` pre	May 07, 2017
`3.2.1` patch	Oct 31, 2016
`3.2.0` minor	Aug 13, 2016
`3.1.2` patch	Jul 27, 2016
`3.1.1` patch	Mar 24, 2016
`3.1.0` minor	Nov 15, 2015
`3.0.5` patch	Oct 01, 2015
`3.0.4` patch	Sep 10, 2015

5.6.0 minor

Oct 17, 2025

5.4.3 patch

Feb 06, 2025

5.5.0 minor

Jan 26, 2025

5.4.2 patch

Nov 07, 2024

5.4.1 patch

Nov 06, 2024

5.4.0 minor

Oct 08, 2024

5.3.0 minor

Apr 11, 2024

5.2.0 minor

Nov 20, 2023

5.1.0 minor

Oct 31, 2023

5.0.0 major

Feb 25, 2023

4.3.0 minor

Jan 02, 2023

4.2.1 patch

Aug 19, 2022

4.2.0 minor

Aug 19, 2022

4.1.5 patch

Sep 28, 2021

4.0.4 patch

Sep 28, 2021

3.4.6 patch

Sep 28, 2021

4.1.4 patch

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Mar 23, 2021

4.0.3 patch

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Mar 23, 2021

4.1.3 patch

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Mar 19, 2021

4.0.2 patch

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Mar 19, 2021

4.1.2 patch

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Feb 19, 2021

4.1.1 patch

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Feb 16, 2021

3.4.5 patch

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Feb 16, 2021

3.4.4 patch

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Feb 10, 2021

4.1.0 minor

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Jan 28, 2021

4.0.1 patch

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Jan 28, 2021

3.4.3 patch

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Jan 27, 2021

3.4.2 patch

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Dec 03, 2020

3.4.1 patch

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Nov 27, 2020

4.0.0 major

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Nov 25, 2020

3.4.0 minor

1 CVE

CVE-2021-41106 GHSA-7322-jrq4-x5hf Sep 29, 2021

File reference keys leads to incorrect hashes on HMAC algorithms

4.4 / 10

Medium

Local Low Low None Unchanged Low Low None

Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

Patches

All versions have been patched to always load the file contents, deprecated the Lcobucci\JWT\Signer\Key\LocalFileReference, and suggest Lcobucci\JWT\Signer\Key\InMemory as the alternative.

Workarounds

Use Lcobucci\JWT\Signer\Key\InMemory instead of Lcobucci\JWT\Signer\Key\LocalFileReference to create the instances of your keys:

-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');

Affected versions


          3.4.0


          3.4.1


          3.4.2


          3.4.3


          3.4.4


          3.4.5


          4.0.0


          4.0.1


          4.0.2


          4.0.3


          4.1.0


          4.1.1

+ 3 more


            4.1.2


            4.1.3


            4.1.4

Fixed in


          3.4.6


          4.0.4


          4.1.5

References

Updated Jul 08, 2026 · Source: OSV.dev

Nov 25, 2020

4.0.0-beta1 pre

Nov 20, 2020

3.3.3 patch

Aug 20, 2020

3.3.2 patch

May 22, 2020

3.3.1 patch

May 24, 2019

3.3.0 minor

May 22, 2019

4.0.0-alpha3 pre

Apr 16, 2019

4.0.0-alpha2 pre

Feb 05, 2019

3.2.5 patch

Nov 11, 2018

3.2.4 patch

Aug 03, 2018

3.2.3 patch

Jul 29, 2018

3.2.2 patch

Sep 01, 2017

4.0.0-alpha1 pre

May 07, 2017

3.2.1 patch

Oct 31, 2016

3.2.0 minor

Aug 13, 2016

3.1.2 patch

Jul 27, 2016

3.1.1 patch

Mar 24, 2016

3.1.0 minor

Nov 15, 2015

3.0.5 patch

Oct 01, 2015

3.0.4 patch

Sep 10, 2015

Activity

Reach

Details