JWT Forgery and Algorithm Confusion

CriticalIdentity & AccessA07:2021 – Identification and Authentication Failures

An attacker forges or tampers with JSON Web Tokens by exploiting weak signing secrets, the none algorithm, or confusion between asymmetric and symmetric algorithms, gaining arbitrary identities or roles.

Immediate Response

1Rotate signing keys and invalidate all outstanding tokens.
2Patch or reconfigure the verification library to accept only the expected algorithm.
3Review access logs for actions taken with forged identities.
4Disable affected endpoints if verification cannot be fixed immediately.

All playbooks

1Pin allowed algorithms explicitly in verification code and reject none.
2Ignore token-supplied key URLs and resolve keys only from a trusted JWKS endpoint.
3Replace weak HMAC secrets with at least 256-bit random keys or move to asymmetric signing.
4Validate iss, aud, exp, and nbf claims on every request.

Long-term Prevention

1Use maintained, well-reviewed JWT libraries and keep them updated.
2Keep access tokens short-lived and use refresh token rotation.
3Add JWT tampering cases to automated security tests.
4Store signing keys in a KMS or HSM and rotate them on a schedule.

Attack vectors

Tokens accepted with alg set to none
RS256 tokens re-signed as HS256 using the public key as the HMAC secret
Brute forcing weak HMAC secrets offline
Injected jku, x5u, or kid header values pointing to attacker-controlled keys

Indicators of compromise

Tokens in logs with unexpected alg, kid, or jku header values
Valid sessions for users who never logged in
Role or tenant claims that do not match the user directory
Authentication succeeding without corresponding identity provider events

Tooling

JWT ToolBurp Suitejwt.io debuggerSemgrep