Injection: JWT Weak Secret Bruteforced¶

Identifier: jwt_weak_secret

Scanner(s) Support¶

Description¶

JWT weak secret vulnerabilities occur when HMAC-signed tokens (e.g. HS256) rely on a short, common, or predictable signing key. Attackers can recover the secret through dictionary or brute-force attacks and forge arbitrary tokens, gaining unauthorized access or privilege escalation.

How we test: We observe JWTs signed with an HMAC algorithm and attempt to recover the signing secret using a curated wordlist of common and weak keys. If a secret is found that validates the token signature, the server is using a weak JWT secret.

Prerequisites:

• The scan must observe an authenticated request that uses a JWT signed with an HMAC algorithm (e.g. HS256).

References:

• CWE-287: Improper Authentication
• OWASP API Security Top 10 API2:2023 Broken Authentication
• OWASP Web Security Testing Guide: Testing JSON Web Tokens
• NIST SP 800-63B: Digital Identity Guidelines

Configuration¶

Example¶

Example configuration:

---
security_tests:
  jwt_weak_secret:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.