PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

6.0 · CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N · score source

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Impact The experimental Chacha20Poly1305 key-encryption algorithm generates the 16-byte Poly1305 authentication tag during encryptKey() but discards it: the tag is never written to the header and therefore never reaches the wire. On the receiving side, decryptKey() calls openssldecrypt('chacha20-poly1305', ...) without the tag argument, which makes OpenSSL skip authentication entirely. As a result the AEAD construction is silently degraded to unauthenticated ChaCha20: a tampered encrypted CEK is accepted, and because ChaCha20 is a stream cipher, a single-byte change in the ciphertext propagates as a single-byte change in the recovered CEK with no integrity check (CWE-353 / CWE-347). An attacker on the token path can manipulate the wrapped key without detection. Affected configurations Applications that register Jose\Experimental\KeyEncryption\Chacha20Poly1305 (package web-token/jwt-experimental) as a JWE alg. Patches encryptKey() now publishes the Poly1305 tag as the base64url tag…

Published by the source

18 Jun 2026, 21:08 UTC

Last modified by the source

18 Jun 2026, 21:08 UTC

Source last checked

26 Oct 2026, 14:49 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-6vvh-pxr4-25r7

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-6vvh-pxr4-25r7

Advisory: PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption
IDs: GHSA-6vvh-pxr4-25r7
Record: https://patchnext.com/advisories/ghsa-6vvh-pxr4-25r7 (revision 1, source checked 26 Oct 2026, 14:49 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.0)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Partial vendor fix; fixed versions by package: web-token/jwt-library 4.1.7, 4.0.7, 3.4.10. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist web-token/jwt-experimental: affected <= 4.1.6
- Packagist web-token/jwt-library: affected < 3.4.10; >= 4.0.0, < 4.0.7; >= 4.1.0, < 4.1.7; fixed in 4.0.7, 3.4.10, 4.1.7

## Suggested inspection (read-only)
- Packagist web-token/jwt-experimental: check the installed version with your package manager.
- Packagist web-token/jwt-library: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on web-token/jwt-experimental, web-token/jwt-library.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-6vvh-pxr4-25r7 (GitHub-reviewed advisory GHSA-6vvh-pxr4-25r7 lists affected ranges: Packagist web-token/jwt-experimental >=0 =0 =4.0.0 =4.1.0 <4.1.7)

Commands are suggestions: review each one before running it.