# JWT issuer mismatch: token 'iss' claim does not match the expected issuer for this application

- **ID:** `security/jwt-issuer-mismatch-allows-token-forgery`
- **Domain:** security
- **Category:** auth_error
- **Error Code:** `JWT_ISSUER_MISMATCH`
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

JWT validation does not verify the 'iss' (issuer) claim, allowing an attacker to forge a token from a different, trusted issuer (e.g., a compromised internal service) to access resources.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| jsonwebtoken 9.0.0 | active | — | — |
| PyJWT 2.8.0 | active | — | — |
| jjwt 0.12.0 | active | — | — |
| Keycloak 22.0.0 | active | — | — |
| Auth0 JWT 1.0.0 | active | — | — |

## Workarounds

1. **Add issuer validation in JWT verification middleware. Example in Node.js using jsonwebtoken library: `jwt.verify(token, secret, { issuer: 'https://auth.myapp.com' })`. Ensure the expected issuer is configured per environment.** (95% success)
   ```
   Add issuer validation in JWT verification middleware. Example in Node.js using jsonwebtoken library: `jwt.verify(token, secret, { issuer: 'https://auth.myapp.com' })`. Ensure the expected issuer is configured per environment.
   ```
2. **Use OpenID Connect Discovery to fetch and validate issuer dynamically: verify `iss` matches the issuer URL of the identity provider.** (90% success)
   ```
   Use OpenID Connect Discovery to fetch and validate issuer dynamically: verify `iss` matches the issuer URL of the identity provider.
   ```

## Dead Ends

- **** — Audience claim checks the intended recipient, not the issuer; an attacker can still forge a token from a different issuer with a matching audience. (80% fail)
- **** — Whitelisting all issuers defeats the purpose; an attacker can use any trusted issuer's signing key to forge tokens. (90% fail)
- **** — Completely bypasses the security check, making the application vulnerable to cross-issuer token forgery. (99% fail)