What Is a JWT Attack and Is Your Login System Vulnerable?

What is a JWT attack and is your login system vulnerable?

JSON Web Tokens — JWTs — have become the standard way that modern web applications manage user authentication. When you log into a website and stay logged in as you navigate between pages, there is a reasonable chance that a JWT is handling your session. The widespread adoption of JWTs has made JWT vulnerabilities one of the most consistently impactful categories of web security issues.

What JWTs are and how they work

A JWT is a small piece of data that a server creates when you log in. It contains information about who you are and what you are allowed to do — your user ID, your role, when the token expires. This data is encoded and signed by the server using a secret key, then sent to your browser.

When you make requests to the application — loading your profile, placing an order, accessing admin functionality — your browser sends the JWT back with each request. The server verifies the signature to confirm the token has not been tampered with, then uses the data inside to determine who you are and what you can do.

The security of the entire system depends on the signature being unforgeatable. JWT attacks target the weaknesses in how that signature is created and verified.

The most common JWT attacks

The algorithm confusion attack exploits a fundamental design flaw in some JWT implementations. JWTs include a header that specifies which algorithm was used to sign the token. Some vulnerable implementations will use whatever algorithm the token claims — including "none," which means no signature at all. An attacker can modify a JWT to claim it uses the "none" algorithm, remove the signature entirely, and change the payload to give themselves admin privileges. The server accepts the token because it follows the instructions in the header rather than enforcing a fixed algorithm.

The weak secret attack targets JWTs signed with a weak or default secret key. JWT signatures using the HMAC algorithm depend on the strength of the secret key. If the key is short, predictable, or a default value left unchanged from a framework's documentation, attackers can brute-force it offline. Once they have the secret, they can sign any JWT they create — including ones that grant admin access.

The key confusion attack occurs when a system uses both asymmetric (public/private key) and symmetric algorithms. If an application is configured to accept both RS256 (asymmetric) and HS256 (symmetric), an attacker can take the application's public key — which is often publicly available — and use it as the HMAC secret to sign a fraudulent token.

What attackers can do with a JWT vulnerability

A successful JWT attack typically results in complete authentication bypass. An attacker can forge a token that grants them any level of access — including administrative privileges — without knowing any legitimate user's password.

The consequences range from accessing other users' data to complete takeover of the application's admin functionality. Because JWTs are often used in API authentication, a JWT vulnerability can expose every API endpoint in the application.

How JWT vulnerabilities get fixed

Pin the algorithm explicitly in your server-side verification code — never trust the algorithm specified in the token header. Use a strong, randomly generated secret key of at least 256 bits. Implement proper token expiry and rotation. Consider using a well-maintained JWT library rather than implementing token verification manually.

Yrzo AI runs a JWT attack suite as one of its 44 automated security checks, testing your application's token handling for algorithm confusion, weak secrets, and other common JWT vulnerabilities. Starting at £399.