Lab: JWT authentication bypass via jku header injection
Summary: PortSwigger's lab demonstrates a JWT authentication bypass in which the server accepts a jku header parameter but does not verify that the supplied URL belongs to a trusted domain before fetching the key. The exercise walks through hosting a JWK Set on an exploit server, pointing the jku header at it, setting the sub claim to administrator, and signing the token with a self-generated RSA key to reach /admin and delete the user carlos.
Bottom line: A single missing check on where a signing key is fetched from turns a token the attacker signs themselves into an administrator session, and the lab's end state is deleting another user's account through /admin/delete?username=carlos.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026