Dec 16, 2020
The most common JWT vulnerabilities are:
- Algorithm manipulation
- Lack of signature validation
- Bruteforcing weak secret keys
- Secret keys leaking through another attack (like directory traversal, XXE, or SSRF)
- Key ID (KID) manipulation
- JKU/JWK/x5u/x5c headers used sending rogue keys
- Information leaks in JWT when developers forget that base64 encoding is not encrypting
Read more on: https://apisecurity.io/issue-56-common-jwt-attacks-owasp-api-security-top-10-cheatsheet/
