JWT arbitrary x5u header supported
Summary: PortSwigger Research describes a JWT vulnerability in which a server implicitly trusts the optional "x5u" header, a URL pointing to the X.509 public key certificate or chain used to verify the token's signature. An attacker can point "x5u" at an external server holding a certificate they generated, re-sign the token with the matching private key, and if the server accepts it, supply an arbitrary claim such as changing "username": "joe" to "username": "admin" to escalate privileges or impersonate other users.
Why it matters: A server that trusts the "x5u" header verifies signatures against a key the attacker supplies, so a single modified header can turn a valid token into an admin token. PortSwigger recommends restricting the header in the underlying JWT parsing library even when the application does not use it directly.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026