File reference keys leads to incorrect hashes on HMAC algorithms
Closed, ResolvedPublic
Actions

Assigned To

None

Authored By

	Reedy
	Dec 31 2025, 9:27 PM

Project Tags

Referenced Files

None

Subscribers

Aklapper

Reedy

Tgr

Description

https://github.com/lcobucci/jwt/security/advisories/GHSA-7322-jrq4-x5hf

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	Update league/oauth2-server and dependancies	Reedy	mediawiki/extensions/OAuth	master	+269 -339

Customize query in gerrit

Related Objects

Mentioned Here: T261462: Migrate OAuth extension back from wikimedia/oauth2-server fork to upstream

Event Timeline

Reedy created this task.Dec 31 2025, 9:27 PM

Restricted Application added a project: MediaWiki-Core-Platform-Team. · View Herald TranscriptDec 31 2025, 9:27 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Reedy added a project: Security.Dec 31 2025, 9:27 PM

Change #1222275 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OAuth@master] Update league/oauth2-server and dependancies

https://gerrit.wikimedia.org/r/1222275

gerritbot added a project: Patch-For-Review.Dec 31 2025, 9:33 PM

OWresch-WMF moved this task from Inbox, needs triage to Kanban on the MediaWiki-Core-Platform-Team board.Jan 5 2026, 3:49 PM

OWresch-WMF edited projects, added: MediaWiki-Core-Platform-Team (Kanban); removed: MediaWiki-Core-Platform-Team.

JTweed-WMF moved this task from Essential Work to OKR Work on the MediaWiki-Core-Platform-Team (Kanban) board.Jan 13 2026, 11:02 AM

OWresch-WMF moved this task from OKR Work to Blocked on the MediaWiki-Core-Platform-Team (Kanban) board.Feb 2 2026, 3:39 PM

Reedy added a project: Vuln-VulnComponent.Feb 2 2026, 10:51 PM

Reedy moved this task from Backlog to Patch released upstream on the Upstream board.

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

Just for the record, we weren't affected by this:

RsaJwtCodec (core JWT session cookies) uses InMemory, not LocalFileReference (also RSA, not HS*)
AccessTokenEntity (OAuth 2 access tokens) uses LocalFileReference but RSA, not HS*
SpecialMWOAuth::outputJWT() (OAuth1 OIDC-ish tokens), CheckUser and ContentTranslation use HS256 but via a different library

Change #1222275 merged by jenkins-bot: