Lab: JWT authentication bypass via algorithm confusion
Summary: This PortSwigger lab presents a JWT session mechanism that signs and verifies tokens with an RSA key pair but is vulnerable to algorithm confusion attacks because of implementation flaws. The server exposes its public key as a JWK Set at /jwks.json, and the walkthrough uses that key as an HMAC secret to sign a token with alg set to HS256 and sub set to administrator, gaining access to /admin and deleting the user carlos.
What's compelling: The flaw turns a public verification key into a signing secret: anyone who can read /jwks.json can mint an admin token, so a single algorithm check left unenforced hands over the admin panel and the ability to delete accounts.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026