security auth_error ai_generated true

JWT RS256 public key used as HMAC secret allows token forgery

ID: security/jwt-rs256-public-key-as-hmac-secret

Also available as: JSON · Markdown · 中文

85%Fix Rate

88%Confidence

1Evidence

2023-08-15First Seen

Version Compatibility

Version	Status	Introduced	Deprecated	Notes
jsonwebtoken 8.5.1	active	—	—	—
PyJWT 2.4.0	active	—	—	—
jjwt 0.9.1	active	—	—	—

Root Cause

The JWT library uses the public key as a symmetric secret for HS256 when the server trusts the 'alg' header without validating against a whitelist, enabling attackers to forge tokens.

generic

中文

JWT库在服务器未对'alg'头进行白名单验证时，将公钥用作HS256对称密钥，使攻击者可以伪造令牌。

Official Documentation

https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

Workarounds

95% success Explicitly whitelist allowed algorithms in JWT verification, e.g., in Node.js: jwt.verify(token, publicKey, { algorithms: ['RS256'] })
```
Explicitly whitelist allowed algorithms in JWT verification, e.g., in Node.js: jwt.verify(token, publicKey, { algorithms: ['RS256'] })
```
90% success Validate the 'alg' header against a server-side list before any cryptographic operation, rejecting tokens with unexpected algorithms like 'none' or 'HS256'
```
Validate the 'alg' header against a server-side list before any cryptographic operation, rejecting tokens with unexpected algorithms like 'none' or 'HS256'
```
85% success Use asymmetric-only libraries that reject symmetric algorithms by default, e.g., jose in Python with require_kid=False
```
Use asymmetric-only libraries that reject symmetric algorithms by default, e.g., jose in Python with require_kid=False
```

中文步骤

Explicitly whitelist allowed algorithms in JWT verification, e.g., in Node.js: jwt.verify(token, publicKey, { algorithms: ['RS256'] })

Validate the 'alg' header against a server-side list before any cryptographic operation, rejecting tokens with unexpected algorithms like 'none' or 'HS256'

Use asymmetric-only libraries that reject symmetric algorithms by default, e.g., jose in Python with require_kid=False

Dead Ends

Common approaches that don't work:

95% fail
Removes integrity checks entirely, making all tokens forgeable.
80% fail
Does not restrict the algorithm whitelist; attacker can still switch to HS256.
70% fail
Issuer verification does not prevent algorithm confusion; token header can be modified.