diff --git a/src/JWT.php b/src/JWT.php index 6d30e941..d45052cf 100644 --- a/src/JWT.php +++ b/src/JWT.php @@ -98,6 +98,9 @@ public static function decode($jwt, $key, $allowed_algs = array()) } if (is_array($key) || $key instanceof \ArrayAccess) { if (isset($header->kid)) { + if (!isset($key[$header->kid])) { + throw new UnexpectedValueException('"kid" invalid, unable to lookup correct key'); + } $key = $key[$header->kid]; } else { throw new UnexpectedValueException('"kid" empty, unable to lookup correct key');