Knowledge Base
In-depth technical articles on JWT vulnerabilities - cryptographic mechanics, vulnerable code patterns, real-world bug bounty cases, and mitigations.
How JWTs are encoded, which header fields matter to an attacker, and how the JOSE family of standards fits together.
The server decodes the token but never calls the cryptographic verification function - any forged payload is accepted.
RFC 7518 legitimises "none" as a valid algorithm. Vulnerable libraries accept unsigned tokens when the header says so.
Switch alg from RS256 to HS256 - the library treats the RSA public key as the HMAC secret, which the attacker already knows.
The kid header selects which key to use. Unsanitised, it becomes a path traversal, SQL injection, or SSRF vector.
Embed your own RSA public key in the JWT header. A vulnerable server uses it to verify - against the attacker's own key.
Point jku at an attacker-controlled JWKS endpoint. The server fetches and trusts it for verification.
Recover the RSA public key from two signatures via GCD - without server access - then chain to algorithm confusion.