Weak JWT Secret Key / Verification

High Severity Technical Guide

Vulnerability Description

JSON Web Tokens (JWT) signed with weak secrets can be brute-forced offline, allowing attackers to forge tokens, tamper with payload claims, and impersonate any user.

Remediation Guide

To resolve this vulnerability, follow these config changes or developer practices:

Sign JWTs with strong, randomly generated keys (at least 256-bit cryptographically secure keys) or use asymmetric signing algorithms like RS256. Validate the alg header strictly.

Verify Your Fix

After applying the remediation, run an external attack-surface scan to verify that the vulnerability is no longer detected by WebScanify.

Is your website vulnerable?

Run a free security scan now to identify missing headers, outdated JS, and other deployment vulnerabilities.