JWT arbitrary jku header supported
Summary: The JSON Web Signature specification defines an optional "jku" header containing a URL to a set of keys used to sign the JWT, and PortSwigger Research describes how an application that implicitly trusts this header may verify signatures using an arbitrary public key fetched from a URL the client can tamper with. An attacker could point "jku" at an external server holding a JSON Web Key Set they generated, re-sign the token with the matching private key, and if the server accepts it, change a claim such as "username": "joe" to "username": "admin" to escalate privileges or impersonate other users.
What's compelling: A single trusted header turns into full account takeover: anyone who can edit the token can supply their own signing key and rewrite their own claims to admin. PortSwigger's fix is to verify "jku" against a whitelist of trusted values and to restrict the header in the underlying JWT parsing library even when the application does not use it directly.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026