The reported vulnerability involves the SimpleJWT PHP library, which allows an unauthenticated attacker to trigger a denial of service by tampering with the JSON Web Encryption (JWE) header when PBES2 algorithms are used. By providing a malicious JWE token to any component that calls JWE::decrypt(), an attacker can exhaust server resources and cause the application to become unresponsive or crash. This flaw is classified under CWE‑325 (Missing Authentication) and CWE‑400 (Uncontrolled Resource Consumption).

Applications built with the SimpleJWT library that decrypt user‑supplied JWE tokens, specifically those that employ PBES2 key derivation algorithms and are running a version earlier than 1.1.1, are affected. The issue originates in the kelvinmo:simplejwt package and impacts any PHP code using JWE::decrypt() with attacker‑controlled input.

The CVSS score of 7.5 indicates a high severity, yet the EPSS score is below 1%, suggesting a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted JWEs to any exposed endpoint that accepts decryption requests; no authentication is required, and the impact is limited to service disruption rather than data theft or code execution.