JWT none algorithm supported
Summary: PortSwigger Research describes a JWT vulnerability in which a server accepts tokens using the "none" algorithm, meaning it may accept tokens with no signature at all. Because the JWT header can be tampered with client-side, an attacker can set "alg" to "none", strip the signature, and if the server still accepts the token, supply an arbitrary payload claim such as changing "username": "joe" to "username": "admin" to escalate privileges or impersonate other users.
What you should know: A single accepted unsigned token lets an attacker rewrite their own identity claim to admin, so the exposure is full account takeover rather than a failed login. The source also warns that even applications not using unsecured JWTs must confirm their underlying parsing library restricts the "alg": "none" header.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026