JWT Misuse
High · Authentication
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-347
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-347
Definition
alg=none, weak secrets, or trusting unverified claims.
Root cause
Homegrown JWT validation bugs.
Affected components
- Components in the “Authentication” class
- Application / API handlers
- Supporting libraries
Impact
Auth bypass / privilege escalation.
Severity
High
Safe lab reproduction
PortSwigger JWT labs
Detection methodology
Token tampering tests; alg confusion checks.
Evidence examples
- Lab reproduction notes: PortSwigger JWT labs
- Request/response excerpts (redacted)
- Detection signal: Token tampering tests; alg confusion checks
Remediation
Use vetted libraries; enforce alg allow-list; short TTL + rotation.
Secure coding examples
Never accept alg=none; validate iss/aud/exp.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.