JWT Vulnerabilities

What it is

JWT (JSON Web Token) vulnerabilities occur when tokens are improperly implemented or validated. Common issues include accepting the none algorithm (no signature), algorithm confusion (switching RS256 to HS256 and signing with the public key), weak HMAC secrets susceptible to brute-force, and key injection via the JWK header parameter.

Attack Vectors

• Authentication tokens in Authorization headers
• Cookie-based JWT session management
• API authentication
• OAuth/OIDC access and ID tokens

Testing Methodology

1. Decode the JWT (base64) and examine the header and payload
2. Test alg: none by removing the signature and setting algorithm to none
3. Test RS256 to HS256 confusion by signing the token with the server's public key as HMAC secret
4. Brute-force the HMAC secret with jwt-cracker or hashcat
5. Test for sensitive data exposure in unencrypted payload

Indicators of Vulnerability

• Token with alg:none accepted by the server
• Token signed with different algorithm than expected is accepted
• Payload claims (role, admin) accepted from forged token

Detection Guidance

Enforce explicit algorithm allowlists in JWT verification. Never accept the none algorithm in production. Monitor for JWT decoding errors.

Mitigation & Remediation

• Explicitly specify and enforce the expected algorithm in JWT validation
• Never accept the none algorithm in production
• Use a strong, randomly generated secret key (256+ bits for HMAC)
• Validate all claims (exp, iss, aud) on the server
• Disable JKU/JWK header parameter processing unless specifically required

References

• PortSwigger JWT Attacks
• OWASP JWT Cheat Sheet
• OWASP Hunting — JWT Vulnerabilities (upstream)