Sensitive PII or credential fields exposed in decoded JWT payload claims

Ethan Andrews@eandrews

•updated Jul 2, 2026•3•0•3

This rule monitors SIEM-ingested HTTP or API gateway traffic for JSON Web Tokens (JWT) where the base64url-encoded payload claims contain sensitive identifiers such as 'password' or 'role'. Detection of these fields in unencrypted JWT claims indicates poor development practices leading to excessive data exposure or potential credential leakage within web session management.