JWT learning path

Orientation and first principles — what the bug class is and how it behaves.

1. Top 3 security best practices for handling JWTs
   8 min readsnyk.io2026
   Library for secure JWT handling that details three best practices: keeping tokens secret by using HTTPS and secure storage like HttpOnly/Secure cookies, validating tokens by checking signatures, expiration, issuer, and audience using libraries like PyJWT, and setting expiration times to limit token lifespan. The library also highlights how Snyk can identify vulnerabilities related to these practices, such as weak encryption or missing flags.
2. The Ultimate Guide to JWT Vulnerabilities and Attacks
   10 min readpentesterlab.com2026
   Library detailing JSON Web Token (JWT) vulnerabilities and attacks, including signature verification failures, the "none" algorithm bypass, weak secret brute-forcing for HS256, and algorithm confusion attacks like RS256 to HS256 swaps and ES256 to HS256 swaps. The resource provides hands-on exercises for practicing these exploits, covering common implementation flaws and defense strategies.
3. Top 3 security best practices for handling JWTs
   8 min readsnyk.io2026
   Library for securely handling JWTs, focusing on three core best practices: keeping tokens secret via HTTPS and secure storage (HttpOnly, Secure flags), validating tokens by checking signatures and claims (exp, nbf, iss, aud), and setting expiration times. It highlights how tools like Snyk can identify vulnerabilities related to these practices, mentioning Python libraries such as Flask-JWT-Extended and PyJWT.
4. Curity: JWT Security Best Practices
   16 min readcurity.io2026
   Library detailing JWT security best practices for applications. It emphasizes that JWT security stems from proper implementation and validation, not the format itself. Key recommendations include fully validating signatures, issuers, and audiences; avoiding interchangeable ID and access tokens; omitting sensitive data from JWTs; utilizing short-lived tokens; and employing asymmetric signing keys with centralized management. The document also discusses the risks of placing sensitive information or API details within tokens, suggesting phantom or split token approaches, and highlights the importance of secure algorithm selection and validation against an allow-list, specifically warning against the "none" algorithm.
5. RFC 8725: JSON Web Token Best Current Practices
   16 min readietf.org2026
   Reference for RFC 8725, updating RFC 7519, this document provides actionable guidance for secure implementation and deployment of JSON Web Tokens (JWTs). It addresses common vulnerabilities such as algorithm confusion attacks (including "none" algorithm and RS256 to HS256 transitions), weak symmetric keys, mismatches between signed and encrypted token validation, and encryption length leakage from compression attacks. The guidance also covers input validation issues with ECDH-ES and concerns related to older JSON encoding standards, aiming to mitigate attacks like CVE-2015-9235 and CVE-2023-51774.

Real testing methodology, tooling, and writeups that show the work.

1. How JWT Libraries Block Algorithm Confusion: Code Review Lessons
   11 min readpentesterlab.com2026
   Library code review lessons demonstrate how JWT libraries block algorithm confusion attacks. Vulnerabilities arise when applications incorrectly verify tokens, allowing attackers to manipulate the `alg` header. Libraries like brianvoe/sjwt and Corviz/jwt mitigate this by supporting only HMAC. Others, such as garyf/json_web_token and nowakowskir/php-jwt, enforce algorithm matching between the header and the verification call. The auth0/java-jwt library employs a defense-in-depth approach, first verifying header-algorithm consistency and then relying on the developer-specified algorithm for verification. jpadilla/pyjwt detects improper use of public keys with HMAC algorithms.
2. November CTF Challenge: Exploiting JWT vulnerabilities to achieve RCE
   9 min readintigriti.com2026
   Walkthrough of a CTF challenge exploiting JWT vulnerabilities, including the 'none' algorithm attack, to achieve remote code execution on the AquaCommerce! e-commerce platform. This guide details reconnaissance steps using Wappalyzer, JWT decoding, privilege escalation to 'admin' role, and server-side template injection (SSTI) in the profile display name field to locate the flag.
3. Golang JWT access restriction bypass vulnerability
   5 min readsnyk.io2026
   Library for Go JWT access restriction bypass vulnerability affecting the `VerifyAudience` function. Discovered issues with double-quoted empty strings bypassing audience verification, leading to CVE-2020-28361. While a fix was available in v4.0.0-preview1, many projects used the master branch, leaving them vulnerable. Snyk's research team identified this and other proprietary Go vulnerabilities, enriching their Intel Vulnerability Database to provide broader security coverage.
4. WorkOS: JWT algorithm confusion attacks explained
   7 min readworkos.com2026
   Library detailing JWT algorithm confusion attacks, a critical vulnerability where servers trust metadata within tokens to dictate verification algorithms. This breakdown covers the classic RS256 to HS256 swap, where an RSA public key is used as an HMAC secret, and related vectors like the `alg: none` attack and JWKS injection via `jku` and `x5u`. It highlights real-world exploits in libraries like Node.js's `jsonwebtoken`, Python's `PyJWT`, and others, emphasizing defensive patterns such as pinning algorithms explicitly and ignoring embedded key references.
5. I made a full JWT hacking tutorial + testing suite
   7 min readhakluke.com2026
   Tool that decodes, edits, and forges JSON Web Tokens (JWTs), demonstrating attacks like `alg:none`, algorithm confusion, and `kid` injection. It provides a step-by-step walkthrough for each technique, explaining JWT structure and signature verification bypasses. The suite operates entirely client-side, ensuring tokens and secrets remain on the user's machine.

Novel research, edge cases, and the techniques that push the class forward.

1. Intigriti: Exploiting JWT vulnerabilities — advanced exploitation guide
   11 min readintigriti.com2026
   Guide to exploiting JWT vulnerabilities, this resource details seven methods for testing misconfigurations. It covers the 'none' algorithm, missing signature validation, and algorithm confusion attacks, including examples like CVE-2018-0114 and JWK spoofing. The guide explains JWT structure and emphasizes the risks of neglecting security specifications during implementation.
2. Stealing Microsoft Teams access tokens in 2025
   3 min readblog.randorisec.fr2025
   Analysis of Microsoft Teams token extraction reveals a method to retrieve encrypted access tokens stored on disk. Initially, tokens were in plaintext within an SQLite database, but newer versions encrypt them using DPAPI. The process involves monitoring file writes with Sysinternals ProcMon to identify the `msedgewebview2.exe` process, which accesses the `Cookies` file. The DPAPI encryption key is found in a local state JSON file. A Proof of Concept in Rust decrypts these tokens using AES-256-GCM, enabling interactions with the Microsoft Graph API via tools like GraphSpy.