JWT self-signed JWK header supported
Summary: PortSwigger Research describes a JWT flaw in which a server implicitly trusts the optional "jwk" header, which carries key information for signature verification, and so verifies tokens using an attacker-supplied public key. An attacker can insert or modify the "jwk" header with a self-generated RSA public key, re-sign the token with the matching private key, and if the server accepts it, change a claim such as "username": "joe" to "admin" to escalate privileges or impersonate other users.
Bottom line: A single trusted header turns a signed token into attacker-controlled identity: anyone who can generate an RSA keypair can potentially rewrite their own username claim to "admin" and have the server accept it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026