JWT Algorithm Confusion
Critical · Authentication
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-347
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-347
Definition
Server accepts unexpected alg (none/HS/RS confusion).
Root cause
Custom JWT validation bugs.
Affected components
- Components in the “Authentication” class
- Application / API handlers
- Supporting libraries
Impact
Forged tokens, privilege escalation.
Severity
Critical · CVSS 9.1
Safe lab reproduction
lab-jwt-alg
Detection methodology
alg header tampering tests.
Evidence examples
- Lab reproduction notes: lab-jwt-alg
- Request/response excerpts (redacted)
- Detection signal: alg header tampering tests
Remediation
Allow-list algorithms; use vetted JWT libs.
Secure coding examples
Reject none; separate keys for HS vs RS.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.