Learn how JSON Web Token authentication actually breaks — hands-on, against a live target. Forge an unsigned token to impersonate another user, then crack a weak signing secret to mint an administrator token in the SessionHub lab.
JSON Web Tokens carry a user's identity and permissions in a signed, self-contained string. The server trusts the claims inside a token — who you are, what role you hold — only because the signature verifies. Broken authentication is what happens when that trust is misplaced: when a token can be forged, replayed, or signed with a key an attacker can recover.
JWT flaws are deceptively common because the token looks opaque, so teams assume it is tamper-proof. In practice the weaknesses live in how the token is verified — a check that honours an attacker-chosen algorithm, a signature that is never validated, or a signing secret weak enough to crack offline. Any API that hands out bearer tokens is a candidate.
When an application trusts the algorithm declared inside the token, an attacker can submit an unsigned token, rewrite the identity claim, and be served another user's data. Authentication collapses without a single password being guessed.
If tokens are signed with a weak secret, that key can be recovered offline from a single captured token. With the key in hand, an attacker signs their own token with an elevated role — turning a normal account into a full administrator.
Authentication weaknesses map to A07:2021 – Identification and Authentication Failures in the OWASP Top 10 (formerly A2:2017 Broken Authentication), and to Broken Authentication in the OWASP API Security Top 10. JWT handling is where these show up most often in modern token-based APIs. The impact classes below are what make them high-severity findings.
| Impact | What the attacker gains | Severity |
|---|---|---|
| Identity forgery | Impersonate other users via unsigned tokens | High |
| Privilege escalation | Forge an admin token from a cracked secret | High |
| Session hijacking | Reuse or extend tokens that are never invalidated | Medium |
| Account takeover | Full control of a targeted user or admin account | High |
The core lesson of Room 11 is that automation and human judgment are a pipeline, not a competition. An autonomous scan maps the attack surface in minutes — the exposed paths, the API endpoints, the open ports. But a JWT authentication flaw is a logic bug: it only reveals itself when you capture a token, reason about how it is verified, and forge a new one. That's the gap a human closes.
In the lab, you run a real PhantomRed scan against SessionHub, read the surface it maps, then take over manually to break the authentication the scanner can't see:
This continues the pipeline Room 10 introduced with a dedicated API security lab — where broken object-level authorization and mass assignment were the target. JWT attacks are the authentication half of the same story: breaking who the API thinks you are.
The SessionHub lab is live and free to play. Run a real autonomous scan, then break the authentication the scanner can't see — forge an identity, then escalate to admin, end to end.