The newest JSON Web Tokens (JWT) resources are on the JSON Web Tokens (JWT) page. For a reading order instead of a date order, see the JSON Web Tokens (JWT) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-11 2026 | HackerOne: Critical vulnerability in JWE Specification news | HackerOne: Critical vulnerability in JWE Specification → hackerone.com |
| 2026-04-11 2026 | HackerOne: Argo CD JWT audience claim not verified news | HackerOne: Argo CD JWT audience claim not verified → hackerone.com |
| 2026-04-11 2026 | JWT Signature Bypass via unvalidated jku parameter intermediate 1 min read | Technique for bypassing JWT signature verification using an unvalidated 'jku' parameter. This vulnerability allows attackers to control the JWK Set URL, enabling them to sign forged tokens with their own keys. Remediation involves strictly validating the 'jku' parameter against an allowlist of trusted URLs or disabling the parameter support entirely, and disabling HTTP redirects when fetching JWKS. → invicti.com |
| 2026-04-11 2026 | JWT Signature Bypass via kid Path Traversal intermediate 1 min read | Technique for JWT signature bypass via 'kid' path traversal, where manipulating the Key ID header parameter with directory traversal sequences allows attackers to force the application to use an attacker-controlled file as the signing key. This bypasses authentication by enabling the creation of validly-signed JWT tokens with arbitrary payloads. Remediation involves validating and sanitizing the 'kid' parameter using allowlisting or mapping tables, storing keys securely, and utilizing robust JWT libraries. → invicti.com |
| 2026-04-11 2026 | JWT Signature Bypass via kid SQL injection intermediate 1 min read | Vulnerability writeup detailing JWT Signature Bypass via `kid` SQL injection. This flaw arises when the `kid` header parameter is used to query a database for cryptographic keys without proper input sanitization, enabling attackers to inject SQL and forge JWTs. Remediation involves using parameterized queries, strict `kid` validation, secure error handling, and robust key management. → invicti.com |
| 2026-04-11 2026 | JWT Attack Walk-Through - NCC Group intermediate 2 min read | Walkthrough of JWT attack vectors, detailing vulnerabilities within JSON Web Tokens. This analysis, from NCC Group's Exploit Development Group, leverages their expertise in cryptography and vulnerability research to illustrate real-world exploitation techniques, contributing to improved cyber resilience. |
| 2026-04-11 2026 | A Practical Guide to Attacking JWT intermediate | A Practical Guide to Attacking JWT |
| 2026-04-11 2026 | Hacker Tools: JWT_Tool beginner 4 min read | Tool for validating, forging, scanning, and tampering with JWT tokens. JWT_Tool facilitates reconnaissance by viewing token claims, performs active scans for misconfigurations, and aids in fuzzing applications and cracking weak secrets. It supports specific attacks like the none algorithm attack (CVE-2015-9235) and RS256 to HS256 key confusion attacks (CVE-2016-5431). → intigriti.com |
| 2026-04-11 2026 | November CTF Challenge: Exploiting JWT vulnerabilities to achieve RCE intermediate 9 min read | Walkthrough of a CTF challenge exploiting JWT vulnerabilities, including the 'none' algorithm attack, to achieve remote code execution on the AquaCommerce! e-commerce platform. This guide details reconnaissance steps using Wappalyzer, JWT decoding, privilege escalation to 'admin' role, and server-side template injection (SSTI) in the profile display name field to locate the flag. → intigriti.com |
| 2026-04-11 2026 | RFC 8725 - JSON Web Token Best Current Practices beginner 16 min read | Reference detailing Best Current Practices for JSON Web Tokens (JWTs). This document updates RFC 7519, offering actionable guidance for secure JWT implementation and deployment by addressing common attack vectors. It covers issues such as algorithm confusion ("none" algorithm, RS256 to HS256), weak symmetric keys, failure to validate internal signatures in encrypted JWTs, information leakage from encryption algorithms, invalid curve point validation in ECDH-ES, and JSON encoding ambiguities. The document references mitigations for these vulnerabilities and is intended for JWT library implementers, developers using JWTs, and specification authors. |
| 2026-04-11 2026 | Cracking JWT Keys - Authentication Lab intermediate 1 min read | Walkthrough of JWT key cracking techniques, demonstrating how to steal, guess, or brute-force HMAC secret keys to forge valid tokens. The lab utilizes tools like John the Ripper and Hashcat, with keys crackable on a standard workstation using common wordlists. It highlights the process of obtaining a token, cracking its key, modifying claims, re-signing, and submitting the forged token, referencing JWT.IO for debugging. |
| 2026-04-11 2026 | Brute Forcing HS256 is Possible intermediate 8 min read | Tool demonstrating the possibility of brute-forcing HS256-signed JSON Web Tokens by exploiting weak shared secrets. The article details the structure of JWTs, the HS256 and RS256 signing algorithms, and provides instructions for compiling and using a multi-threaded `jwt-cracker` tool to recover secrets from compromised tokens. It highlights the importance of using secret keys that meet or exceed the hash output size as specified by RFC7518 to prevent such attacks. |
| 2026-04-11 2026 | Golang JWT access restriction bypass vulnerability intermediate 5 min read | Library for Go JWT access restriction bypass vulnerability affecting the `VerifyAudience` function. Discovered issues with double-quoted empty strings bypassing audience verification, leading to CVE-2020-28361. While a fix was available in v4.0.0-preview1, many projects used the master branch, leaving them vulnerable. Snyk's research team identified this and other proprietary Go vulnerabilities, enriching their Intel Vulnerability Database to provide broader security coverage. → snyk.io |
| 2026-04-11 2026 | Top 3 security best practices for handling JWTs beginner 8 min read | Library for securely handling JWTs, focusing on three core best practices: keeping tokens secret via HTTPS and secure storage (HttpOnly, Secure flags), validating tokens by checking signatures and claims (exp, nbf, iss, aud), and setting expiration times. It highlights how tools like Snyk can identify vulnerabilities related to these practices, mentioning Python libraries such as Flask-JWT-Extended and PyJWT. → snyk.io |
| 2026-04-11 2026 | Detecting JWT Security Issues beginner 4 min read | Library for detecting JWT security issues in Node.js applications. It identifies vulnerabilities arising from the insecure use of the `jsonwebtoken` npm package, specifically the misuse of `jwt.decode()` which bypasses signature verification and can lead to broken authentication. The library also flags hardcoded sensitive data, insufficient logging, and lack of rate limiting, providing recommendations for secure JWT handling. → snyk.io |
| 2026-04-11 2026 | Attacking JWT authentication intermediate 4 min read | Library for testing JWT authentication implementations, detailing how to identify JWTs and exploit common vulnerabilities. Techniques covered include checking for sensitive data, manipulating signing algorithms (e.g., `none` or switching from RS256 to HS256), and cracking weak HS256 secret keys using tools like `jwtbrute` and John the Ripper. |
| 2026-04-11 2026 | Lab: JWT authentication bypass via weak signing key intermediate 2 min read | Lab: JWT authentication bypass via weak signing key, detailing a process to exploit a weak signing key in JSON Web Tokens. This involves using Burp Suite's JWT Editor extension to brute-force the secret key with `hashcat`, generating a new symmetric key in JWK format, and then modifying the JWT's payload to gain administrative access. → portswigger.net |
| 2026-04-11 2026 | Lab: JWT authentication bypass via jku header injection intermediate 2 min read | Lab: JWT authentication bypass via jku header injection. This lab demonstrates an authentication bypass vulnerability in JSON Web Tokens by injecting a malicious JWK Set. Using the Burp Suite JWT Editor extension, attackers can upload a controlled JWK Set, modify the JWT header to reference it with a `jku` parameter, and then sign the token with their own key. This allows them to impersonate legitimate users and gain unauthorized access, as shown by escalating privileges to access an admin panel. → portswigger.net |
| 2026-04-10 2026 | PortSwigger KB: JWT none algorithm supported intermediate 1 min read | Library for detecting JWT "none" algorithm vulnerabilities. This flaw allows an attacker to tamper with the JWT's `alg` header to "none", remove the signature, and submit an unsigned token. If the server accepts this, attackers can escalate privileges or impersonate users by modifying arbitrary claims in the payload. Remediation involves configuring JWT libraries to reject unsecured tokens and only accept cryptographically strong algorithms. → portswigger.net |
| 2026-04-10 2026 | Intigriti: Exploiting JWT vulnerabilities — advanced exploitation guide advanced 11 min read API Sec Bug Bounty | Guide to exploiting JWT vulnerabilities, this resource details seven methods for testing misconfigurations. It covers the 'none' algorithm, missing signature validation, and algorithm confusion attacks, including examples like CVE-2018-0114 and JWK spoofing. The guide explains JWT structure and emphasizes the risks of neglecting security specifications during implementation. → intigriti.com |
| 2026-04-10 2026 | Vaadata: JWT vulnerabilities, common attacks and security best practices beginner 15 min read | Library on JSON Web Token (JWT) vulnerabilities, covering their structure including JOSE header, payload, and signature. It details common attack vectors that exploit weak implementations and outlines security best practices for configuration and usage, emphasizing the importance of secure secret management for algorithms like HS256 and RS256. → vaadata.com |
| 2026-04-10 2026 | WorkOS: JWT algorithm confusion attacks explained intermediate 7 min read | Library detailing JWT algorithm confusion attacks, a critical vulnerability where servers trust metadata within tokens to dictate verification algorithms. This breakdown covers the classic RS256 to HS256 swap, where an RSA public key is used as an HMAC secret, and related vectors like the `alg: none` attack and JWKS injection via `jku` and `x5u`. It highlights real-world exploits in libraries like Node.js's `jsonwebtoken`, Python's `PyJWT`, and others, emphasizing defensive patterns such as pinning algorithms explicitly and ignoring embedded key references. |
| 2026-04-10 2026 | PentesterLab: Another JWT Algorithm Confusion Vulnerability (CVE-2024-54150) news 3 min read | Writeup of CVE-2024-54150, detailing an algorithm confusion vulnerability in the xmidt-org/cjwt library. The flaw occurs when the library fails to properly distinguish between HMAC and asymmetric signature verification, allowing an attacker to use an HMAC signature with an RSA public key. This technique can lead to unauthorized access by exploiting weak signature validation. → pentesterlab.com |
| 2026-04-10 2026 | Curity: JWT Security Best Practices beginner 16 min read | Library detailing JWT security best practices for applications. It emphasizes that JWT security stems from proper implementation and validation, not the format itself. Key recommendations include fully validating signatures, issuers, and audiences; avoiding interchangeable ID and access tokens; omitting sensitive data from JWTs; utilizing short-lived tokens; and employing asymmetric signing keys with centralized management. The document also discusses the risks of placing sensitive information or API details within tokens, suggesting phantom or split token approaches, and highlights the importance of secure algorithm selection and validation against an allow-list, specifically warning against the "none" algorithm. |
| 2026-04-10 2026 | RFC 8725: JSON Web Token Best Current Practices beginner 16 min read | Reference for RFC 8725, updating RFC 7519, this document provides actionable guidance for secure implementation and deployment of JSON Web Tokens (JWTs). It addresses common vulnerabilities such as algorithm confusion attacks (including "none" algorithm and RS256 to HS256 transitions), weak symmetric keys, mismatches between signed and encrypted token validation, and encryption length leakage from compression attacks. The guidance also covers input validation issues with ECDH-ES and concerns related to older JSON encoding standards, aiming to mitigate attacks like CVE-2015-9235 and CVE-2023-51774. |
| 2026-04-10 2026 | Auth0: Critical vulnerabilities in JSON Web Token libraries news 7 min read | Library vulnerabilities in node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt allow attackers to bypass verification using the "None" algorithm or by forging tokens with asymmetric keys like RS256 and ES256. Attackers can exploit the RSA vs. HMAC confusion by using a public key as an HMAC secret, leading to arbitrary token forgery. This analysis highlights the critical need for library developers to explicitly specify algorithms during verification and for users to audit dependencies. |
| 2026-04-10 2026 | OWASP WSTG: Testing JSON Web Tokens intermediate 8 min read | Reference detailing OWASP's Web Security Testing Guide (WSTG) procedures for testing JSON Web Tokens (JWTs). It covers analyzing JWT headers and payloads for sensitive data, testing for tampering vulnerabilities, and verifying signature integrity. Specific attack vectors discussed include exploiting the "none" algorithm, the ECDSA "psychic signatures" vulnerability (CVE-2022-21449), weak HMAC key cracking using tools like crackjwt.py and John the Ripper, and HMAC vs. public key confusion attacks. → owasp.org |
| 2026-04-10 2026 | KathanP19/HowToHunt: JWT beginner 11 min read | Library detailing JSON Web Token (JWT) security, covering its structure (header, payload, signature), symmetric and asymmetric encryption (HS256, RS256), and common vulnerabilities. It explores attacks such as the "none" algorithm bypass, algorithm substitution (RS256 to HS256), signature validation failures, and secret key cracking using tools like Hashcat and JWT_Tool. The library also highlights insecure header parameters like `kid`, `jku`, `jwk`, `x5u`, `x5c`, and `x5t`. |
| 2026-04-10 2026 | tuhin1729 Bug Bounty Methodology: JWT beginner 1 min read | Reference to JWT attacks, detailing methods such as modifying the body when signatures are unchecked or exist, brute-forcing weak signatures, and exploiting the "None" algorithm. It also covers attacks against RS256 by finding public keys, manipulating the `kid` parameter for URL redirection, accessing publicly readable files, and injecting commands or SQL queries. The entry includes steps for setting up and using the `jwt_tool` for automated analysis. |
| 2026-04-10 2026 | HackTricks: JWT vulnerabilities intermediate 13 min read | Library for exploring JSON Web Token (JWT) vulnerabilities, detailing techniques like signature bypass using `jwt_tool` and `SignSaboteur`, exploiting `alg=none`, and key confusion attacks that leverage RS256 with a public key as a shared secret. It also covers crafting JWE tokens by exploiting pac4j-jwt vulnerabilities and forging tokens using leaked encryption keys and user data. → book.hacktricks.xyz |
| 2026-04-10 2026 | PayloadsAllTheThings: JSON Web Token beginner 10 min read | Library detailing JSON Web Token (JWT) security flaws, including format, signature bypasses like CVE-2020-28042 and CVE-2015-9235, key confusion attacks (CVE-2016-5431), and key injection. It also covers tools such as `ticarpi/jwt_tool`, `c-jwt-cracker`, and `JOSEPH`, along with insights into signature disclosure vulnerabilities like CVE-2019-7644 and the "None" algorithm exploit. |
| 2026-04-10 2026 | DontPanicO/jwtXploiter: A tool to test the security of JSON Web Tokens intermediate 2 min read | Tool for testing JSON Web Token (JWT) security. This application facilitates tampering with token payloads, exploiting vulnerable header claims like `kid`, `jku`, and `x5u`, verifying tokens, and performing key confusion attacks. It supports all JSON Web Algorithms (JWAs), generates JWKs, and integrates with `pip` and `dpkg`. Targeted at web application penetration testers, bug bounty hunters, and developers needing to secure JWT implementations. |
| 2026-04-10 2026 | brendan-rius/c-jwt-cracker: JWT brute-force cracker in C intermediate 3 min read | Library for multi-threaded JWT brute-force cracking written in C. It supports HMAC hash functions like HS256, HS384, and HS512, allowing users to specify custom alphabets and secret lengths. The tool leverages OpenSSL for hashing and includes build instructions for Docker and native compilation on Linux and macOS, noting potential Base64 implementation issues. |
| 2026-04-10 2026 | mazen160/jwt-pwn: Security testing scripts for JWT intermediate 1 min read | Library of scripts for security testing of JSON Web Tokens (JWT). Includes tools for brute-forcing secrets with `jwt-cracker.py` and `go-jwt-cracker`, decoding JWT values, generating new JWTs signed with HS256, and creating unsigned JWTs. These scripts aid in identifying vulnerabilities related to JWT implementation. |
| 2026-04-10 2026 | jwt_tool Attack Methodology wiki intermediate 13 min read | Library providing an attack methodology for testing JSON Web Tokens (JWTs). It details a workflow, beginning with setup using intercepting proxies like Burp Suite or ZAP, and then enumerates various checks and exploits. These include verifying token requirement and persistence, analyzing claim processing before validation, and exploiting common vulnerabilities such as the 'none' algorithm (CVE-2015-9235), RSA key confusion (CVE-2016-5431), JWKS injection (CVE-2018-0114), and null signatures (CVE-2020-28042). The library also covers advanced techniques like "kid" issues, URL tampering, JWKS spoofing, and cross-service relay attacks. |
| 2026-04-10 2026 | ticarpi/jwt_tool: A toolkit for testing, tweaking and cracking JSON Web Tokens intermediate 6 min read | Library for validating, forging, scanning, and tampering with JSON Web Tokens (JWTs). It identifies vulnerabilities like `alg=none` (CVE-2015-2951), RS/HS256 public key mismatch (CVE-2016-10555), key injection (CVE-2018-0114), and blank password (CVE-2019-20933/CVE-2020-28637) by fuzzing claims, testing secrets, performing dictionary attacks, and enabling timestamp tampering. The tool also supports RSA and ECDSA key generation and reconstruction, rate-limiting, and can directly send tokens to target URLs or files for automated testing against applications. |
| 2026-04-10 2026 | Working with JWTs in Burp Suite intermediate 2 min read | Library for testing JWT authentication bypass vulnerabilities in Burp Suite. It allows users to view and decode JWTs within Burp Inspector, and then utilize the JWT Editor extension to generate cryptographic signing keys, edit token headers and payloads, and resign the modified JWT with a valid signature. The extension automatically flags requests containing JWTs, streamlining the identification and manipulation process. → portswigger.net |
| 2026-04-10 2026 | JSON Web Token Attacker Burp extension intermediate | Extension that assists in pentesting applications utilizing JavaScript Object Signing and Encryption (JOSE), specifically targeting JSON Web Tokens. This tool automates the discovery and testing of vulnerabilities within JOSE implementations, aiding security professionals in identifying potential weaknesses during application assessments. → portswigger.net |
| 2026-04-10 2026 | JWT Scanner Burp extension intermediate | Extension for Burp Suite that scans for JWT vulnerabilities by highlighting tokens and initiating scans. It supports forging public keys when they are not exposed, allowing for further exploitation and vulnerability discovery by rerunning scans after successful forging. → portswigger.net |
| 2026-04-10 2026 | PortSwigger jwt-editor: Burp Suite extension for editing and signing JWTs intermediate 5 min read | Library for manipulating JSON Web Tokens (JWTs) within Burp Suite, this tool detects and allows editing, signing, verifying, encrypting, and decrypting JWTs in HTTP and WebSocket messages. It offers detection of JWTs, highlighting, and an Intruder payload provider. Functionality includes importing/exporting cryptographic keys, editing JWS/JWE components with JSON and hex editors, and performing attacks such as "none" algorithm bypass, HMAC key confusion, embedded JWK, signing with an empty HMAC key, Psychic signatures (CVE-2022-21449), and collaborator integration. |
| 2026-04-10 2026 | Algorithm confusion attacks | Web Security Academy intermediate 5 min read | Reference detailing algorithm confusion attacks, also known as key confusion attacks, where an attacker manipulates JWT verification by forcing a server to use an unintended algorithm. This often exploits flawed JWT library implementations where a single verification method handles multiple algorithms, allowing an attacker to use a public key as a symmetric secret for HS256 verification when RS256 was intended. The entry outlines obtaining the server's public key, converting it to the correct format, and signing a forged JWT with HS256 using that public key. It also covers deriving public keys from existing tokens using tools like `jwt_forgery.py` or `portswigger/sig2n`. → portswigger.net |
| 2026-04-10 2026 | JWT attacks | Web Security Academy beginner 13 min read | Library detailing JSON Web Token (JWT) vulnerabilities, covering design flaws and incorrect handling that lead to high-severity attacks such as privilege escalation and user impersonation. It explains JWT format, signature verification, and common exploitation techniques, including accepting arbitrary or no signatures, and provides practical labs for safe exploitation against realistic targets. Burp Suite Professional 2022.5.1 is mentioned for its automated detection capabilities. → portswigger.net |
| 2026-01-12 2026 | dr34mhacks/jwtauditor: JWT Auditor – Analyze, break, and understand your tokens like a pro. intermediate 3 min read Python | Tool for analyzing and exploiting JWT security vulnerabilities. JWTAuditor offers automated detection for over 15 vulnerability types, including algorithm confusion, KID parameter injection, and sensitive data exposure, with detailed explanations and remediation advice. It features secret bruteforcing, a JWT editor, token generator, and seven specialized attack modules, all processed client-side for enhanced privacy. It supports various signing algorithms like HS256 and RS256, and facilitates testing through RSA key generation and signature verification. |
| 2025-10-27 2025 | Stealing Microsoft Teams access tokens in 2025 advanced 3 min read AuthN | Analysis of Microsoft Teams token extraction reveals a method to retrieve encrypted access tokens stored on disk. Initially, tokens were in plaintext within an SQLite database, but newer versions encrypt them using DPAPI. The process involves monitoring file writes with Sysinternals ProcMon to identify the `msedgewebview2.exe` process, which accesses the `Cookies` file. The DPAPI encryption key is found in a local state JSON file. A Proof of Concept in Rust decrypts these tokens using AES-256-GCM, enabling interactions with the Microsoft Graph API via tools like GraphSpy. |
| 2025-09-05 2025 | Authentication Explained: When to Use Basic, Bearer, OAuth2, JWT & SSO | daily.dev beginner AuthN AuthZ | Guide to authentication and authorization models, detailing when to use Basic, Bearer tokens, OAuth2, JWT, and SSO. It contrasts RBAC, ABAC, and ACL authorization strategies and explains how applications like GitHub and Stripe integrate these for robust security, emphasizing the importance of selecting appropriate mechanisms based on application complexity and specific requirements. |
| 2024-09-05 2024 | JWT vs PASETO: New Era of Token-Based Authentication intermediate API Sec AuthN | This article delves into a comprehensive comparison of Paseto and JWT, dissecting their core functionalities, security features, and… |
| 2024-08-16 2024 | Securing OAuth 2.0 Token Exchange Flow with Keycloak intermediate API Sec AuthN | RFC 8693: Token Exchange describes a mechanism for exchanging an existing token (JWT) for a new token with different issuing client id… |
| 2023-05-21 2023 | JWT (Json Web Token) Audience aud versus Client_Id - What's the difference? beginner 3 min read AuthN | Reference on the JWT `aud` (Audience) claim, clarifying its role in identifying intended recipients and the responsibility of token processors to validate this claim. It explains that `aud` can be a string or array of strings, application-specific, and optional, unlike the unrelated OAuth Client ID. The document highlights its use case for distinguishing access from refresh tokens and stresses that recipient validation of the `aud` claim is crucial for its effectiveness. → stackoverflow.com |
| 2023-05-09 2023 | All About Attacking JWT intermediate | All About Attacking JWT https://ift.tt/8Rcdsfp |
| 2023-04-02 2023 | JSON Web Tokens Vulnerabilities and Exploitation. intermediate | JSON Web Tokens Vulnerabilities and Exploitation. https://ift.tt/cAwTj6v |