Timing Side Channel Vulnerability in php-jwt

CVE-2024-25191

Summary

The php-jwt 1.0.0 library features an authentication verification flaw that utilizes the strcmp function, which is not a constant-time comparison function. This implementation choice leads to timing discrepancies that can be exploited through side-channel attacks, allowing malicious actors to bypass authentication mechanisms with relative ease. Due to this vulnerability, it becomes significantly easier for attackers to gain unauthorized access, posing serious security risks to applications relying on this library.

References