Catalog/VULNERABILITY/jwt-security
SCAN-ID: JWT-SECURITYREVISION 2026.4
VULNERABILITYCVSS 9.1 (CRITICAL)

JWT Security & Algorithm Scanner

Test for weak HMAC keys, 'alg': 'none' authentication bypasses, and unverified token signature flaws.

Technical Scope & Verification Behavior

Examines token headers, expiration enforcement (exp claim), symmetric key confusion attacks, and brute-forces short signing secrets.

Automated Inspection Checks (9)
Passive URL parameter fuzzing
Non-destructive boundary tests
Header & cookie flag assertions
Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

{"alg": "none", "typ": "JWT"}.{"role": "admin"}.

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)
Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

Strict Algorithm Enforcement

patch.diff (typescript)
--- a/handler.typescript (Vulnerable)
jwt.verify(token, secret);
+++ b/handler.typescript (Remediated)
jwt.verify(token, secret, { algorithms: ['HS256'] });

Explicitly restrict accepted JWT algorithms to prevent algorithm downgrade attacks like 'none'.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Update jwt.verify options to explicitly specify algorithms: ['HS256'] and reject tokens missing expiration claims."

Run Isolated Check

Test your public domain specifically for JWT Security & Algorithm Scanner.

100% passive • No server load

Specification Details

CVSS Score
9.1 / 10.0
Severity Level
CRITICAL
Category
VULNERABILITY
Test Vectors
9 automated
Execution SLA
< 2.5 seconds
False Positive Defense
Strict assertion
Related Standards
#JWT#Auth#Tokens#Crypto

Run continuous monitoring for JWT Security & Algorithm Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog