JWT Token Vulnerabilities
JWT vulnerabilities include algorithm confusion attacks (none algorithm), weak signing keys, missing expiration, token replay, and improper validation that can allow attackers to forge or manipulate tokens.
Overview
JSON Web Tokens (JWTs) are widely used for API authentication and authorization. However, numerous vulnerabilities arise from improper implementation: algorithm confusion (accepting "none"), weak signing secrets, missing claim validation, lack of expiration, and token replay. These flaws can allow attackers to forge tokens, escalate privileges, or maintain persistent access.
Types & Variants
Algorithm Confusion
Switching the signing algorithm from RS256 to HS256, using the public key as the HMAC secret.
None Algorithm
Removing the signature verification by setting the algorithm to "none".
Weak Secret
Brute-forcing HMAC-SHA256 secrets to forge arbitrary tokens.
Impact
Authentication bypass, privilege escalation, token forgery, and persistent unauthorized access.
Examples
None Algorithm Attack
Header: {"alg":"none","typ":"JWT"}
Payload: {"sub":"admin","role":"superadmin"}
Signature: (empty)Remediation
Use strong signing algorithms (RS256 or ES256), validate all JWT claims, implement token expiration and rotation, use asymmetric keys, and reject tokens with "none" algorithm.
Explicitly specify and validate the signing algorithm server-side
Reject tokens with "none" algorithm
Use asymmetric algorithms (RS256, ES256) over symmetric (HS256)
Validate all claims: exp, iat, iss, aud, nbf
Implement token rotation and short expiration times
Store tokens securely (avoid localStorage for sensitive tokens)
Related SuperClue scanner checks
These scanner checks look for signs of JWT Token Vulnerabilities. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works