HUNT-JWT-CRYPTO — Forgeable JSON Web Tokens (A04 Cryptographic Failures)

What actually pays

A JWT is header.payload.signature, each base64url. The signature is the only thing stopping you from editing the payload (your identity/role) and replaying it. It pays High/Critical when the verifier can be tricked into accepting a token you forged — so you become another user or an admin without their secret.

Two classic, generic verifier flaws:

• alg:none — the verifier trusts the token's own alg header. Set alg:"none", drop the signature, edit the payload (e.g. role:"admin", another user's id/email). A broken verifier skips signature checking.
• RS256 → HS256 key confusion — the token is signed RS256 (asymmetric). The RSA public key is, by definition, public. If the verifier lets you choose HS256, it will use that public key as the HMAC secret — which you also know. Sign an edited payload with HS256 using the public key and it validates.