JWT Misuse
High · Authentication · CWE-347
Description
alg=none, weak secrets, or trusting unverified claims.
Root cause
Homegrown JWT validation bugs.
Impact
Auth bypass / privilege escalation.
Detection
Token tampering tests; alg confusion checks.
Mitigation
Use vetted libraries; enforce alg allow-list; short TTL + rotation.
Secure coding
Never accept alg=none; validate iss/aud/exp.
Safe lab example
PortSwigger JWT labs
Practise related skills in Labs or deepen on Academy library.