[HIGH] Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption

PKSA-66dc-42nb-26yy GHSA-jc38-x7x8-2xc8

Affected package: web-token/jwt-library

Affected version: <3.4.10|>=4.0.0,<4.0.7|>=4.1.0,<4.1.7

Reported by:
GitHub, FriendsOfPHP/security-advisories