File reference keys leads to incorrect hashes on HMAC algorithms
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.
Summary
JWT is a library to work with JSON Web Token and JSON Web Signature. Prior to versions 3.4.6, 4.0.4, and 4.1.5, users of HMAC-based algorithms (HS256, HS384, and HS512) combined with `Lcobucci\JWT\Signer\Key\LocalFileReference` as key are having their tokens issued/validated using the file path as hashing key - instead of the contents. The HMAC hashing functions take any string as input and, since users can issue and validate tokens, users are lead to believe that everything works properly. Versions 3.4.6, 4.0.4, and 4.1.5 have been patched to always load the file contents, deprecated the `Lcobucci\JWT\Signer\Key\LocalFileReference`, and suggest `Lcobucci\JWT\Signer\Key\InMemory` as the alternative. As a workaround, use `Lcobucci\JWT\Signer\Key\InMemory` instead of `Lcobucci\JWT\Signer\Key\LocalFileReference` to create the instances of one's keys.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lcobucci | jwt | 3.4.0 to before 3.4.6; 4.0.0 to before 4.0.4; 4.1.0 to before 4.1.5 | 3.4.6, 4.0.4, 4.1.5 | Patch available | CNA |
| — | lcobucci/jwt (Packagist) | 3.4.0 to before 3.4.6 | 3.4.6 | Patch available | GHSA-7322-jrq4-x5hf |
| — | lcobucci/jwt (Packagist) | 4.0.0 to before 4.0.4 | 4.0.4 | Patch available | GHSA-7322-jrq4-x5hf |
| — | lcobucci/jwt (Packagist) | 4.1.0 to before 4.1.5 | 4.1.5 | Patch available | GHSA-7322-jrq4-x5hf |
- jwt Vendorlcobucci Affected 3.4.0 to before 3.4.6; 4.0.0 to before 4.0.4; 4.1.0 to before 4.1.5 Fixed in 3.4.6, 4.0.4, 4.1.5 Patch available CNA
- lcobucci/jwt (Packagist) Vendor— Affected 3.4.0 to before 3.4.6 Fixed in 3.4.6 Patch available GHSA-7322-jrq4-x5hf
- lcobucci/jwt (Packagist) Vendor— Affected 4.0.0 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-7322-jrq4-x5hf
- lcobucci/jwt (Packagist) Vendor— Affected 4.1.0 to before 4.1.5 Fixed in 4.1.5 Patch available GHSA-7322-jrq4-x5hf
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lcobucci:jwt:*:*:*:*:*:*:*:* | 3.4.0 to before 3.4.6; 4.0.0 to before 4.0.4; 4.1.0 to before 4.1.5 | Vulnerable | lcobucci |
- cpe:2.3:a:lcobucci:jwt:*:*:*:*:*:*:*:* Versions 3.4.0 to before 3.4.6; 4.0.0 to before 4.0.4; 4.1.0 to before 4.1.5 Vulnerable ·lcobucci
Remediation
- Fix · CNA jwt (lcobucci) Fixed in 3.4.6, 4.0.4, 4.1.5
- Fix · GHSA-7322-jrq4-x5hf lcobucci/jwt (Packagist) Fixed in 3.4.6 Advisory →
- Fix · GHSA-7322-jrq4-x5hf lcobucci/jwt (Packagist) Fixed in 4.0.4 Advisory →
- Fix · GHSA-7322-jrq4-x5hf lcobucci/jwt (Packagist) Fixed in 4.1.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41106
- 2026-10-03 Alias added: GHSA-7322-jrq4-x5hf
References
Patch 3
Sources
- CVE-2021-41106 · CVE Program
- CVE-2021-41106 · NVD
- FIRST EPSS
- GHSA-7322-jrq4-x5hf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences