~/tags/jwt

#jwt

Everything on KSAL currently grouped under the #jwt tag.

2 total entries 1 blog posts 1 writeups

Blog Post Sep 5, 2026

JWT Algorithm Confusion Explained: Forging Tokens with RS256 to HS256

Engineering

How JWT algorithm confusion works, why switching RS256 to HS256 lets an attacker sign their own tokens with a public key, and how to shut it down in your own code.

javelin #jwt #web #authentication #algorithm-confusion #rs256 #hs256 #appsec

Web Sep 14, 2025

Admin Panel Bypass via JWT Algorithm Confusion

BSides Prishtina 2025

A JWT authentication challenge where switching the algorithm from RS256 to HS256 and signing with the server's own public key grants unrestricted admin access.

javelin #jwt #web #authentication #algorithm-confusion #rs256 #hs256 Web