What it is
JWT bugs are dangerous because they look like authentication while skipping the proof. If a backend trusts decoded claims without enforcing the signature algorithm and key, an attacker can mint their own identity.
How it happens
JWT verification must reject unsigned or weakly signed tokens. If an application accepts attacker-controlled token metadata as trusted, identity and authorization claims can be forged.
What an attacker gets
Accepting an unsigned token can allow forged users, roles, tenants, or admin claims depending on what the app stores in JWT payloads. In multi-tenant apps, this can become cross-account data access.
// what fixvibe reports
What FixVibe reports
Runs in active scans of a domain you have verified you own, on Hobby and above. Each finding shows the affected URL or host, its severity and fix steps you can paste into your AI coding tool.
How to fix it
Use the provider SDK or verifier API, allowlist the expected algorithms, and validate issuer, audience, expiration, and signature before using claims. Add tests for `alg: none`, wrong-key, wrong-issuer, and expired tokens.