What is CVE-2025-45769?

CVE-2025-45769 is a medium-severity vulnerability in Google Firebase Php-Jwt, classified under Inadequate Encryption Strength. CVSS score: 6.5/10. Published 2025-07-31.

How severe is CVE-2025-45769?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2025-45769 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Google Firebase Php-Jwt

CVE-2025-45769

php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.

EPSS: 0.001 (3.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Google Firebase_php-jwt
N/a — versions n/a

Weakness classification (CWE)

CWE-326 — Inadequate Encryption Strength

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

Frequently asked questions

What is CVE-2025-45769?: CVE-2025-45769 is a medium-severity vulnerability in Google Firebase Php-Jwt, classified under Inadequate Encryption Strength. CVSS score: 6.5/10. Published 2025-07-31.
How severe is CVE-2025-45769?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2025-45769 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.