6.5

CVE-2025-45769: google firebase_php-jwt Inadequate Encryption Strength

CVSS: 6.5v3.1MediumModified
AliasesCGA-2pc7-fjfp-j5p3CGA-6j3g-h489-jq22CGA-fj2v-phm4-mf79
Published 31-07-2025Last modified 18-02-2026
Open JSON

Vulnerability summary

CVE-2025-45769 is a medium (CVSS 6.5) Inadequate Encryption Strength vulnerability in google firebase_php-jwt. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.6% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.15%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-M6MF-96QF-FJHG

Timeline

  1. 31-07-2025
    PublishedVulnerability first disclosed.
  2. 18-02-2026
    Last modifiedVulnerability information updated.

Description

php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

+0.01 pp

From 0.14% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard4 products
  • zabbix-web-nginx-pgsql-7.0< 7.0.23-r1
  • zabbix-web-nginx-pgsql-7.4< 7.4.7-r1
  • zabbix-web-nginx-pgsql-fips-7.0< 7.0.23-r1
  • zabbix-web-nginx-pgsql-fips-7.4< 7.4.7-r1
Google1 product

2 vendors · 5 products

References

10 links