performing-jwt-none-algorithm-attack

name	performing-jwt-none-algorithm-attack
description	Execute and test the JWT none algorithm attack to bypass signature verification by manipulating the alg header field in JSON Web Tokens.
domain	cybersecurity
subdomain	api-security
tags	["jwt","none-algorithm","authentication-bypass","token-manipulation","signature-bypass","penetration-testing","owasp","web-security"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Performing JWT None Algorithm Attack

Overview

The JWT none algorithm attack exploits a vulnerability in JSON Web Token libraries that accept tokens with the alg header set to none, effectively bypassing signature verification. When a server processes a JWT with "alg": "none", it treats the token as valid without checking any cryptographic signature, allowing attackers to forge tokens with arbitrary claims such as escalated privileges, impersonated users, or extended expiration times. This vulnerability was first disclosed by Tim McLean in 2015 and has affected multiple JWT libraries across languages.

When to Use

• When conducting security assessments that involve performing jwt none algorithm attack
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Most Often Missed & How to Confirm

• alg casing/omission: test none, None, NONE, nOnE, and a header with no alg at all - allowlists that only block lowercase "none" still fall.
• Signature-segment variants: try an empty sig, a trailing-dot-only sig, and a leftover original signature - some libraries accept each differently.
• Claim edits matter: flip role/is_admin/sub while keeping iss/aud/exp valid so the token passes non-signature checks.
• Chain to confusion/weak secret: if none is blocked, try RS256→HS256 confusion and HMAC secret brute-force before concluding safe.
• kid/jwk header injection: CVE-2018-0114-style embedded jwk and kid path traversal can supply attacker keys.

How to confirm a hit (avoid false negatives): the forged token must return authenticated/privileged data from a protected endpoint (e.g., an admin route returns 200 with admin data), not merely avoid a 401 - compare against an unauthenticated baseline. Don't conclude negative until you've tried: all none casings, every signature-segment form, claim manipulation, and the HS256-confusion and weak-secret fallbacks.

Prerequisites