# gree jose signature bypass via none algorithm

Source: https://junglewise.ai/threats/gree-jose-signature-bypass-via-none-algorithm-cad29c66  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-05-15. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 9.8 · Published 2024-05-15

The gree/jose library, used for handling JSON Web Tokens (JWT) in PHP applications, contains a flaw that allows attackers to bypass security checks. By using a specially crafted token that specifies no encryption (the "none" algorithm), an attacker can impersonate other users or gain unauthorized access to sensitive data. This could lead to full account takeover or unauthorized operations within the affected application.

Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 9.8, published 15 May 2024.

**Which products and versions are affected?** gree/jose (Packagist) < 2.2.1.

**Is there a fix for This vulnerability?** A patch was published on 2024-05-15T21:47:39Z: Fix identified in version 2.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run gree/jose (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The gree/jose library is vulnerable to a signature bypass due to improper verification of the 'none' algorithm in JSON Web Tokens (JWT). When a token is presented with the 'alg' header set to 'none', the library may treat the token as valid without verifying a cryptographic signature. This allows a remote, unauthenticated attacker to forge tokens with arbitrary payloads, such as elevated privileges or different user identities, by simply removing the signature and updating the header. The vulnerability is rooted in the improper implementation of CWE-347 and CWE-327. The issue is addressed in version 2.2.1.

## Affected products

- gree jose < 2.2.1

## Timeline

- 2024-05-15: advisory: GitHub Advisory published
- 2024-05-15: patched: Fix identified in version 2.2.1

## References

- [https://api.github.com/users/RainSignal](https://api.github.com/users/RainSignal)
- [https://github.com/RainSignal](https://github.com/RainSignal)
- [https://api.github.com/users/RainSignal/gists%7B/gist_id%7D](https://api.github.com/users/RainSignal/gists%7B/gist_id%7D)
- [https://api.github.com/users/RainSignal/repos](https://api.github.com/users/RainSignal/repos)
- [https://avatars.githubusercontent.com/u/101503193?v=4](https://avatars.githubusercontent.com/u/101503193?v=4)
- [https://api.github.com/users/RainSignal/events%7B/privacy%7D](https://api.github.com/users/RainSignal/events%7B/privacy%7D)

## Related threats

- [PHP JOSE Library by Gree Inc. Uses a Broken or Risky Cryptographic Algorithm](https://junglewise.ai/threats/cve-2016-5431-php-jose-library-by-gree-inc-uses-a-broken-or-risky-cryptographic)