Vulnerabilities / JWT signature is not being verified

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
↓

Severity
High
CWE Name
JWT signature is not being verified
CWE ID
CWE-345
CVSS Score
7.5
Compliance
OWASP TOP10 -> A8
ISO27001 -> A.8.2, A.8.3, A.8.5, A.8.24, A.8.26
JWT signature is not being verified

The JWT signature is not being verified by the server. If the JWT is used to control access to the application, an attacker could take advantage of this vulnerability to forge a token and impersonate other users or even elevate privileges.

How to fix

  • To fix this issue, you should check the signature of the JWT before reading/using the payload content.