JWT signature not verified
Summary: PortSwigger Research describes a JWT vulnerability in which some servers fail to properly verify token signatures, allowing tokens with invalid signatures to be accepted. An attacker can then supply an arbitrary claim in the JWT payload, such as changing "username": "joe" to "username": "admin", to obtain new privileges or impersonate other users.
Why it matters: A single unverified signature turns a token claim into an authorization decision the attacker controls, so a user named joe can become admin without ever touching a password.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026