security auth_error ai_generated true

JWT validation bypass: algorithm confusion attack

ID: security/jwt-algorithm-confusion

Also available as: JSON · Markdown
82%Fix Rate
86%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

JWT algorithm can be changed by attacker to bypass signature.

generic

Workarounds

  1. 92% success Explicitly specify allowed algorithms in verification: algorithms=["RS256"]
  2. 90% success Reject tokens with alg:none or unexpected algorithms

Dead Ends

Common approaches that don't work:

  1. Accept any algorithm in JWT header 92% fail

    Algorithm confusion attack vector

  2. Use symmetric key same as public key 88% fail

    Key confusion vulnerability