PTKDMobile App Security
Knowledge base / PTKD-API-WEAK-JWT
high M3 MASVS-AUTH-1 dynamic analysis PTKD-API-WEAK-JWT

Weak JWT observed on the wire

A JSON Web Token seen in traffic used alg=none (unsigned, trivially forgeable) or carried no expiry, weakening session security.

How it's exploited

A JSON Web Token seen in traffic used alg=none (unsigned) or carried no expiry. An unsigned token can be rewritten to impersonate any user; a token without exp stays valid forever once stolen.

Why it matters

Authentication bypass or indefinite session hijacking, depending on which weakness is present.

How to fix it

  1. Reject alg=none server-side and sign tokens with a strong algorithm (for example, RS256 or ES256).
  2. Always set a short exp and validate signature and expiry on every request.

References