{
  "id": "security/jwt-rs256-public-key-as-hmac-secret",
  "signature": "JWT RS256 public key used as HMAC secret allows token forgery",
  "signature_zh": "JWT RS256公钥被用作HMAC密钥导致令牌伪造",
  "regex": "JWT verification failed.*algorithm.*not allowed|Signature verification failed.*public key.*HMAC",
  "domain": "security",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "The JWT library uses the public key as a symmetric secret for HS256 when the server trusts the 'alg' header without validating against a whitelist, enabling attackers to forge tokens.",
  "root_cause_type": "generic",
  "root_cause_zh": "JWT库在服务器未对'alg'头进行白名单验证时，将公钥用作HS256对称密钥，使攻击者可以伪造令牌。",
  "versions": [
    {
      "version": "jsonwebtoken 8.5.1",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "PyJWT 2.4.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "jjwt 0.9.1",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Removes integrity checks entirely, making all tokens forgeable.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Does not restrict the algorithm whitelist; attacker can still switch to HS256.",
      "fail_rate": 0.8,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Issuer verification does not prevent algorithm confusion; token header can be modified.",
      "fail_rate": 0.7,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Explicitly whitelist allowed algorithms in JWT verification, e.g., in Node.js: jwt.verify(token, publicKey, { algorithms: ['RS256'] })",
      "success_rate": 0.95,
      "how": "Explicitly whitelist allowed algorithms in JWT verification, e.g., in Node.js: jwt.verify(token, publicKey, { algorithms: ['RS256'] })",
      "condition": "",
      "sources": []
    },
    {
      "action": "Validate the 'alg' header against a server-side list before any cryptographic operation, rejecting tokens with unexpected algorithms like 'none' or 'HS256'",
      "success_rate": 0.9,
      "how": "Validate the 'alg' header against a server-side list before any cryptographic operation, rejecting tokens with unexpected algorithms like 'none' or 'HS256'",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use asymmetric-only libraries that reject symmetric algorithms by default, e.g., jose in Python with require_kid=False",
      "success_rate": 0.85,
      "how": "Use asymmetric-only libraries that reject symmetric algorithms by default, e.g., jose in Python with require_kid=False",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Explicitly whitelist allowed algorithms in JWT verification, e.g., in Node.js: jwt.verify(token, publicKey, { algorithms: ['RS256'] })",
    "Validate the 'alg' header against a server-side list before any cryptographic operation, rejecting tokens with unexpected algorithms like 'none' or 'HS256'",
    "Use asymmetric-only libraries that reject symmetric algorithms by default, e.g., jose in Python with require_kid=False"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.88,
  "fix_success_rate": 0.85,
  "resolvable": "true",
  "first_seen": "2023-08-15",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}