5. JWT logic confusion bypassing authentication

If you see a JWT and think:

“It’s signed, so it must be secure”

That’s exactly what attackers rely on.

JWT Algorithm Confusion is not about cracking crypto.
It’s about making the server verify the token in the wrong way — and happily accept a forged one.

No brute force.
No leaked secrets.
Just abusing trust in configuration.

Created by Gemini

List: Wild Bug Bounty Bugs You've Probably Never Seen | Curated by Abhijeet kumawat | Medium

🧠 What JWT Algorithm Confusion Really Is

JWTs have three parts:

HEADER.PAYLOAD.SIGNATURE

The header contains an alg field, like:

{
  "alg": "RS256",
  "typ": "JWT"
}