Description
SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt() on attacker-controlled JWEs using PBES2 algorithms are affected. This issue has been patched in version 1.1.1.
Published: 2026-03-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Unauthenticated)
Action: Apply Patch
AI Analysis

Impact

SimpleJWT, a PHP library for JSON web tokens, allows an attacker to trigger a denial of service by tampering with the JWE header when PBES2 algorithms are used. The flaw lies in the JWE::decrypt() routine, which does not validate the header properly and can be invoked with attacker‑controlled tokens. Because the attack does not require authentication, it compromises availability for any application relying on this library.

Affected Systems

The vulnerability affects the SimpleJWT library from Kelvinmo, in all releases before version 1.1.1. Production systems using unsaved or externally supplied JWE tokens with PBES2 algorithms will be impacted.

Risk and Exploitability

With a CVSS score of 7.5 and an EPSS score below 1%, the risk is high but the likelihood of exploitation is currently low, as the vulnerability is not listed in CISA KEV. An attacker only needs to supply a crafted JWE header to an application that calls JWE::decrypt(), making exploitation straightforward once the input is under their control.

Generated by OpenCVE AI on April 10, 2026 at 02:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply version 1.1.1 or later of SimpleJWT to eliminate the flaw
  • Ensure that any remaining usage of PBES2 algorithms is disabled or tightly validated before decryption
  • Audit application code to guarantee that JWE::decrypt() is invoked only with trusted, non‑attacker‑controlled tokens

Generated by OpenCVE AI on April 10, 2026 at 02:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-xw36-67f8-339x SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
History

Fri, 10 Apr 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Kelvinmo
Kelvinmo simplejwt
CPEs cpe:2.3:a:kelvinmo:simplejwt:*:*:*:*:*:*:*:*
Vendors & Products Kelvinmo
Kelvinmo simplejwt

Tue, 24 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 23 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-325
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 23 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Kelvin Mo
Kelvin Mo simplejwt
Vendors & Products Kelvin Mo
Kelvin Mo simplejwt

Fri, 20 Mar 2026 22:45:00 +0000

Type Values Removed Values Added
Description SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt() on attacker-controlled JWEs using PBES2 algorithms are affected. This issue has been patched in version 1.1.1.
Title SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Kelvin Mo Simplejwt
Kelvinmo Simplejwt
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-24T15:34:35.165Z

Reserved: 2026-03-17T23:23:58.312Z

Link: CVE-2026-33204

cve-icon Vulnrichment

Updated: 2026-03-24T15:34:29.369Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-20T23:16:45.677

Modified: 2026-04-10T01:25:08.487

Link: CVE-2026-33204

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-03-20T22:37:13Z

Links: CVE-2026-33204 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-10T09:46:25Z

Weaknesses