🔒 Academy Room 11 · Hard

Broken Authentication & JWT Attacks

Learn how JSON Web Token authentication actually breaks — hands-on, against a live target. Forge an unsigned token to impersonate another user, then crack a weak signing secret to mint an administrator token in the SessionHub lab.

⚡ Start the JWT Lab How it works →
// Overview

What Is Broken Authentication in JWTs?

JSON Web Tokens carry a user's identity and permissions in a signed, self-contained string. The server trusts the claims inside a token — who you are, what role you hold — only because the signature verifies. Broken authentication is what happens when that trust is misplaced: when a token can be forged, replayed, or signed with a key an attacker can recover.

JWT flaws are deceptively common because the token looks opaque, so teams assume it is tamper-proof. In practice the weaknesses live in how the token is verified — a check that honours an attacker-chosen algorithm, a signature that is never validated, or a signing secret weak enough to crack offline. Any API that hands out bearer tokens is a candidate.

// Why It Matters

Real-World Impact

Identity Forgery

Impersonate any user

When an application trusts the algorithm declared inside the token, an attacker can submit an unsigned token, rewrite the identity claim, and be served another user's data. Authentication collapses without a single password being guessed.

Privilege Escalation

Forge an admin token

If tokens are signed with a weak secret, that key can be recovered offline from a single captured token. With the key in hand, an attacker signs their own token with an elevated role — turning a normal account into a full administrator.

// OWASP

Where JWT Attacks Sit in the OWASP Top 10

Authentication weaknesses map to A07:2021 – Identification and Authentication Failures in the OWASP Top 10 (formerly A2:2017 Broken Authentication), and to Broken Authentication in the OWASP API Security Top 10. JWT handling is where these show up most often in modern token-based APIs. The impact classes below are what make them high-severity findings.

Impact What the attacker gains Severity
Identity forgery Impersonate other users via unsigned tokens High
Privilege escalation Forge an admin token from a cracked secret High
Session hijacking Reuse or extend tokens that are never invalidated Medium
Account takeover Full control of a targeted user or admin account High
// The Workflow

How PhantomRed Fits Into a JWT Assessment

The core lesson of Room 11 is that automation and human judgment are a pipeline, not a competition. An autonomous scan maps the attack surface in minutes — the exposed paths, the API endpoints, the open ports. But a JWT authentication flaw is a logic bug: it only reveals itself when you capture a token, reason about how it is verified, and forge a new one. That's the gap a human closes.

In the lab, you run a real PhantomRed scan against SessionHub, read the surface it maps, then take over manually to break the authentication the scanner can't see:

This continues the pipeline Room 10 introduced with a dedicated API security lab — where broken object-level authorization and mass assignment were the target. JWT attacks are the authentication half of the same story: breaking who the API thinks you are.

// What You'll Learn

Learning Objectives

Concepts

  • How a JWT carries identity and role claims, and why the signature is the trust anchor
  • Why honouring the token's own algorithm header breaks authentication
  • How JWT attacks map onto the OWASP Top 10 and API Security Top 10

Hands-On Skills

  • Reading a scan report to map a token-based API's attack surface
  • Forging an unsigned token to impersonate another user
  • Cracking a weak signing secret to mint an administrator token
// FAQ

Frequently Asked Questions

What is a JSON Web Token (JWT)?
A JSON Web Token is a compact, signed token used to carry authentication and session claims between a client and a server. It has three parts — a header naming the signing algorithm, a payload of claims such as the user identity and role, and a signature. Servers trust the claims only if the signature verifies, so any weakness in how that signature is checked can break authentication entirely.
What is a JWT alg:none attack?
Some libraries honour the algorithm named in the token's own header. If an application accepts a token that declares no signing algorithm, an attacker can strip the signature, rewrite the claims — for example changing the user identity — and have the forged token trusted as valid. It is one of the most common JWT authentication bypasses and the first flaw you exploit in the SessionHub lab.
Is broken authentication in the OWASP Top 10?
Yes. It is A07:2021 — Identification and Authentication Failures (previously A2:2017 Broken Authentication) in the OWASP Top 10, and Broken Authentication is also API2:2023 in the OWASP API Security Top 10. JWT handling flaws are among the most frequently exploited issues in modern token-based APIs.
How do attackers forge JWTs?
Two classic paths: accepting unsigned tokens, where the server trusts a token that declares no signature; and weak signing secrets, where an HMAC-signed token can be cracked offline against a wordlist to recover the key, after which the attacker signs their own admin token. The SessionHub lab has you chain both — forge an identity, then escalate to an administrator.
Can an automated scanner detect JWT authentication flaws?
Scanners are excellent at mapping attack surface — open ports, exposed paths, forbidden endpoints — but JWT authentication flaws are logic bugs. Detecting them requires capturing a token, reasoning about how it is verified, and forging a new one, which passive scanning does not do. PhantomRed maps the surface automatically; the human closes the gap by forging tokens. That workflow is the core lesson of the room.
How do you prevent JWT attacks?
Pin the accepted algorithm server-side instead of trusting the token header, reject unsigned tokens outright, and use a long, random signing secret or asymmetric keys so the signature cannot be cracked or forged. Always verify the signature before reading any claim, keep token lifetimes short, and scope claims to the minimum the request needs.
// Related

Related Rooms & Guides

// Get Started

Practice JWT Attacks Against a Live Target

The SessionHub lab is live and free to play. Run a real autonomous scan, then break the authentication the scanner can't see — forge an identity, then escalate to admin, end to end.

⚡ Open the JWT Lab Start a Free Scan →