Executive brief
A vulnerability exists in the experimental ChaCha20Poly1305 encryption algorithm within the PHP JWT Framework. This library is used to secure web tokens, but a flaw in this specific algorithm fails to verify the integrity of encrypted data. An attacker could potentially tamper with encrypted tokens without being detected, leading to the use of manipulated security keys.
Technical details
The experimental Chacha20Poly1305 key-encryption algorithm in web-token/jwt-framework generates a 16-byte Poly1305 authentication tag during encryption but fails to write it to the JWE header. Consequently, the decryption function calls openssl_decrypt without the required tag argument, causing OpenSSL to skip authentication entirely. This degrades the AEAD construction to unauthenticated ChaCha20. Because ChaCha20 is a stream cipher, an attacker can manipulate the ciphertext to predictably alter the recovered Content Encryption Key (CEK) without triggering an integrity error. Patches have been released in versions 3.4.10, 4.0.7, and 4.1.7 to properly handle the authentication tag.
Affected products
- web-token jwt-experimental <= 4.1.6
- web-token jwt-library < 3.4.10, >= 4.0.0 < 4.0.7, >= 4.1.0 < 4.1.7
Timeline
- 2026-06-06: disclosed
- 2026-06-18: advisory