Skip to content
REDMAW

Applications

JWT Algorithm Confusion

Token validation fails when an application accepts an attacker-controlled or misread signing method and trusts a token that should never have been valid.

RedMaw

Definition

A JSON Web Token carries claims and a signature. Algorithm confusion arises when the verifying party lets the token itself influence how verification happens, rather than deciding that in advance and refusing anything else.

How the failure works

  1. 01The application reads the algorithm declared in the token header
  2. 02It selects a verification routine based on that declaration
  3. 03An attacker supplies a token declaring a different method
  4. 04Verification succeeds against a key or process that was never meant to authorize this token
  5. 05The application accepts the claims inside, including identity and role

The consequence is not a malformed request. It is a request that arrives fully authenticated as somebody else.

Where it leads
  1. Attacker
  2. Forged Token
  3. API
  4. Privileged Function
  5. Sensitive Data

Each hop validated by successful exploitation

Tags

  • jwt
  • authentication
  • authorization

Validation

How RedMaw validates this attack

Validation runs only inside authorized scope, with agreed exploitation limits.

  1. 01Establish how the application selects a verification method
  2. 02Attempt tokens that declare an unexpected algorithm
  3. 03Determine whether forged claims are accepted
  4. 04Confirm what privileged function the accepted token reaches

Keep going

Related

Capabilities

Use cases

Stop assuming you are secure. Prove it.

Continuously test what an attacker can actually reach across your applications, SaaS identities, internal infrastructure and AI systems.

Request a demoExplore the platform