{
  "slug": "jwt-weaknesses",
  "url": "https://library.infinity8labs.com/jwt-weaknesses/",
  "title": "JSON Web Token (JWT) weaknesses",
  "short": "JWT weaknesses",
  "aliases": [
    "JWT validation flaws",
    "Insecure JWT handling",
    "Token signature bypass"
  ],
  "summary": "JWT weaknesses occur when applications decode tokens without fully validating their signature, algorithm, issuer, audience, lifetime, and key source. Attackers may forge identities or privileges that the server treats as trusted.",
  "cwe": [
    "CWE-347",
    "CWE-287"
  ],
  "owasp": "A07:2021 Identification and Authentication Failures",
  "typical_severity": {
    "min": "medium",
    "max": "critical"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-347: Improper Verification of Cryptographic Signature",
      "url": "https://cwe.mitre.org/data/definitions/347.html"
    },
    {
      "title": "RFC 8725: JSON Web Token Best Current Practices",
      "url": "https://www.rfc-editor.org/rfc/rfc8725.html"
    },
    {
      "title": "OWASP JSON Web Token Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Top 10 A07:2021 Identification and Authentication Failures",
      "url": "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"
    },
    {
      "title": "PortSwigger Web Security Academy: JWT attacks",
      "url": "https://portswigger.net/web-security/jwt"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/jwt-weaknesses/#overview",
    "https://library.infinity8labs.com/jwt-weaknesses/#impact",
    "https://library.infinity8labs.com/jwt-weaknesses/#examples",
    "https://library.infinity8labs.com/jwt-weaknesses/#remediation",
    "https://library.infinity8labs.com/jwt-weaknesses/#testing",
    "https://library.infinity8labs.com/jwt-weaknesses/#references"
  ]
}