{
  "@id": "urn:uuid:4d36ad4e-4cf7-48cb-ba46-ea1d1fbce5c4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T14:33:00.057870+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability AIKIDO-2025-10963 does not affect version 6.11.1-p2+tuxcare of firebase/php-jwt. already_fixed \u2014 The target repository firebase/php-jwt version 6.11.1 has already been fixed for AIKIDO-2025-10963 (Inadequate Encryption Strength). TuxCare applied an identical backport in commit 9d756cb (PHPELSCVE-211) that implements the same key length validation as the upstream patch.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "AIKIDO-2025-10963"
      },
      "impact_statement": "already_fixed \u2014 The target repository firebase/php-jwt version 6.11.1 has already been fixed for AIKIDO-2025-10963 (Inadequate Encryption Strength). TuxCare applied an identical backport in commit 9d756cb (PHPELSCVE-211) that implements the same key length validation as the upstream patch."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-03T10:18:53.426649+00:00",
      "status_notes": "Vulnerability CVE-2021-46743 does not affect version 6.11.1-p2+tuxcare of firebase/php-jwt. Target version 6.11.1 is not affected by CVE-2021-46743. The vulnerability (algorithm-confusion allowing JWT forgery via kid header) was fixed in upstream version 6.0.0 (released 2022-01-24) through the introduction of the Key object that binds key material to its intended algorithm. The target already contains this fix as it was present in the upstream release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-46743"
      },
      "impact_statement": "Target version 6.11.1 is not affected by CVE-2021-46743. The vulnerability (algorithm-confusion allowing JWT forgery via kid header) was fixed in upstream version 6.0.0 (released 2022-01-24) through the introduction of the Key object that binds key material to its intended algorithm. The target already contains this fix as it was present in the upstream release that TuxCare onboarded."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-45769 is fixed in version 6.11.1-p2+tuxcare of firebase/php-jwt.",
      "vulnerability": {
        "name": "CVE-2025-45769"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/firebase/php-jwt@6.11.1-p2+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-10T14:33:00.057870+00:00",
      "status_notes": "Vulnerability GHSA-h533-5v22-8vcp affects version 6.11.1-p2+tuxcare of firebase/php-jwt.",
      "vulnerability": {
        "name": "GHSA-h533-5v22-8vcp"
      },
      "action_statement": "Vulnerability GHSA-h533-5v22-8vcp affects version 6.11.1-p2+tuxcare of firebase/php-jwt."
    }
  ]
}