JWT Signature Not Verified

TaintedPort

Back to App
Vuln ID TP-012 Title JWT Signature Not Verified Severity high Type Broken Authentication HTTP Method GET URL /* Parameter Authorization Filename - Code Location backend/api/config/jwt.php lines 46-48

Description

For HS256 tokens, when the signature doesn't match, the code only logs a warning but still accepts the token. Attackers can modify any JWT payload without the secret key.

Proof of Concept

Modify the user_id in any JWT payload, re-encode without valid signature.

Remediation

Return null (reject the token) when the signature does not match.