JWT Algorithm None Signature Bypass

Tim Peck@timpeck

•updated Dec 22, 2025•5•0•54

Identifies JSON Web Tokens (JWTs) where the signing algorithm in the header ('alg') is set to 'none'. A server that incorrectly trusts this header may skip signature validation, allowing an attacker to create arbitrary tokens and bypass authentication controls.