Security Test: JWT no algorithm¶

Description¶

Default Severity: high

When a server accepts a JWT marked with the 'none' algorithm, it means it's treating an unsigned token as if it were securely signed. This vulnerability arises when the token validation process lets through a token claiming that it hasn’t been signed at all, so an attacker can create or modify tokens to impersonate any user. If developers don’t restrict acceptable algorithms or enforce proper signature checks, it could let attackers gain unauthorized access, create privilege escalation opportunities, and initiate other attacks that compromise sensitive data or system integrity.

Configuration¶

Identifier: injection/jwt_alg_none

Examples¶

All configuration available:

checks:
  injection/jwt_alg_none:
    skip: false # default

Compliance and Standards¶