Vulnerability · Published Jul 31, 2025 · Assigned by mitre
CVE-2025-45770
High 7.0
In plain English
A high-severity security flaw in the php-lcobucci-jwt package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 96.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
jwt v5.4.3 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | php-lcobucci-jwt | no fix listed | DEBIAN-CVE-2025-45770 |
| Debian:14 | php-lcobucci-jwt | no fix listed | DEBIAN-CVE-2025-45770 |
| Ubuntu:24.04:LTS | php-lcobucci-jwt | no fix listed | UBUNTU-CVE-2025-45770 |
| Ubuntu:25.10 | php-lcobucci-jwt | no fix listed | UBUNTU-CVE-2025-45770 |
| Ubuntu:26.04:LTS | php-lcobucci-jwt | no fix listed | UBUNTU-CVE-2025-45770 |
| Ubuntu:26.10 | php-lcobucci-jwt | no fix listed | UBUNTU-CVE-2025-45770 |
Affected products (as reported)
Weakness: CWE-326 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H