JWT learning path

Orientation and first principles — what the bug class is and how it behaves.

1. Top 3 security best practices for handling JWTs
   8 min readsnyk.io2026
   Library for secure JWT handling that details three best practices: keeping tokens secret by using HTTPS and secure storage like HttpOnly/Secure cookies, validating tokens by checking signatures, expiration, issuer, and audience using libraries like PyJWT, and setting expiration times to limit token lifespan. The library also highlights how Snyk can identify vulnerabilities related to these practices, such as weak encryption or missing flags.
2. The Ultimate Guide to JWT Vulnerabilities and Attacks
   10 min readpentesterlab.com2026
   Library detailing JSON Web Token (JWT) vulnerabilities and attacks, including signature verification failures, the "none" algorithm bypass, weak secret brute-forcing for HS256, and algorithm confusion attacks like RS256 to HS256 swaps and ES256 to HS256 swaps. The resource provides hands-on exercises for practicing these exploits, covering common implementation flaws and defense strategies.
3. Curity: JWT Security Best Practices
   16 min readcurity.io2026
   Library detailing JWT security best practices for applications. It emphasizes that JWT security stems from proper implementation and validation, not the format itself. Key recommendations include fully validating signatures, issuers, and audiences; avoiding interchangeable ID and access tokens; omitting sensitive data from JWTs; utilizing short-lived tokens; and employing asymmetric signing keys with centralized management. The document also discusses the risks of placing sensitive information or API details within tokens, suggesting phantom or split token approaches, and highlights the importance of secure algorithm selection and validation against an allow-list, specifically warning against the "none" algorithm.
4. draft-ietf-oauth-rfc8725bis: JSON Web Token Best Current Practices
   30 min readdatatracker.ietf.org2026
   Reference document detailing JSON Web Token (JWT) Best Current Practices. This specification updates RFC 7519 and replaces RFC 8725, offering actionable guidance on secure JWT implementation and deployment. It covers threats and vulnerabilities like weak signatures, insufficient validation, weak symmetric keys, insecure encryption use, plaintext leakage, substitution attacks, and JWE decompression bomb attacks. The document also outlines best practices, including algorithm verification, appropriate algorithm selection, cryptographic input validation, sufficient key entropy, UTF-8 usage, and validation of issuer, subject, and audience claims.
5. Top 3 security best practices for handling JWTs
   8 min readsnyk.io2026
   Library for securely handling JWTs, focusing on three core best practices: keeping tokens secret via HTTPS and secure storage (HttpOnly, Secure flags), validating tokens by checking signatures and claims (exp, nbf, iss, aud), and setting expiration times. It highlights how tools like Snyk can identify vulnerabilities related to these practices, mentioning Python libraries such as Flask-JWT-Extended and PyJWT.

Real testing methodology, tooling, and writeups that show the work.

1. How JWT Libraries Block Algorithm Confusion: Code Review Lessons
   11 min readpentesterlab.com2026
   Library code review lessons demonstrate how JWT libraries block algorithm confusion attacks. Vulnerabilities arise when applications incorrectly verify tokens, allowing attackers to manipulate the `alg` header. Libraries like brianvoe/sjwt and Corviz/jwt mitigate this by supporting only HMAC. Others, such as garyf/json_web_token and nowakowskir/php-jwt, enforce algorithm matching between the header and the verification call. The auth0/java-jwt library employs a defense-in-depth approach, first verifying header-algorithm consistency and then relying on the developer-specified algorithm for verification. jpadilla/pyjwt detects improper use of public keys with HMAC algorithms.
2. Golang JWT access restriction bypass vulnerability
   5 min readsnyk.io2026
   Library for Go JWT access restriction bypass vulnerability affecting the `VerifyAudience` function. Discovered issues with double-quoted empty strings bypassing audience verification, leading to CVE-2020-28361. While a fix was available in v4.0.0-preview1, many projects used the master branch, leaving them vulnerable. Snyk's research team identified this and other proprietary Go vulnerabilities, enriching their Intel Vulnerability Database to provide broader security coverage.
3. I made a full JWT hacking tutorial + testing suite
   7 min readhakluke.com2026
   Tool that decodes, edits, and forges JSON Web Tokens (JWTs), demonstrating attacks like `alg:none`, algorithm confusion, and `kid` injection. It provides a step-by-step walkthrough for each technique, explaining JWT structure and signature verification bypasses. The suite operates entirely client-side, ensuring tokens and secrets remain on the user's machine.
4. November CTF Challenge: Exploiting JWT vulnerabilities to achieve RCE
   9 min readintigriti.com2026
   Walkthrough of a CTF challenge exploiting JWT vulnerabilities, including the 'none' algorithm attack, to achieve remote code execution on the AquaCommerce! e-commerce platform. This guide details reconnaissance steps using Wappalyzer, JWT decoding, privilege escalation to 'admin' role, and server-side template injection (SSTI) in the profile display name field to locate the flag.
5. WorkOS: JWT algorithm confusion attacks explained
   7 min readworkos.com2026
   Library detailing JWT algorithm confusion attacks, a critical vulnerability where servers trust metadata within tokens to dictate verification algorithms. This breakdown covers the classic RS256 to HS256 swap, where an RSA public key is used as an HMAC secret, and related vectors like the `alg: none` attack and JWKS injection via `jku` and `x5u`. It highlights real-world exploits in libraries like Node.js's `jsonwebtoken`, Python's `PyJWT`, and others, emphasizing defensive patterns such as pinning algorithms explicitly and ignoring embedded key references.

Novel research, edge cases, and the techniques that push the class forward.

1. Intigriti: Exploiting JWT vulnerabilities — advanced exploitation guide
   11 min readintigriti.com2026
   Guide to exploiting JWT vulnerabilities, this resource details seven methods for testing misconfigurations. It covers the 'none' algorithm, missing signature validation, and algorithm confusion attacks, including examples like CVE-2018-0114 and JWK spoofing. The guide explains JWT structure and emphasizes the risks of neglecting security specifications during implementation.
2. Stealing Microsoft Teams access tokens in 2025
   3 min readblog.randorisec.fr2025
   Analysis of Microsoft Teams token extraction reveals a method to retrieve encrypted access tokens stored on disk. Initially, tokens were in plaintext within an SQLite database, but newer versions encrypt them using DPAPI. The process involves monitoring file writes with Sysinternals ProcMon to identify the `msedgewebview2.exe` process, which accesses the `Cookies` file. The DPAPI encryption key is found in a local state JSON file. A Proof of Concept in Rust decrypts these tokens using AES-256-GCM, enabling interactions with the Microsoft Graph API via tools like GraphSpy.
3. Smashing the token limit with overlapping fragments
   portswigger.net2026
   This content introduces Alex, a collaborator skilled in web security tools like DOM Invader. Alex demonstrated a technique to exfiltrate larger tokens than previously thought possible by exploiting overlapping fragments. The summary highlights the collaboration and the discovery of an advanced token exfiltration method. No specific bounty payout amount is mentioned.