Exploit Analysis: The JWT Algorithm 'none' Attack (And the Guard)

A single line of configuration can forge a JWT. Here is the technical analysis of the 'none' algorithm attack, and the automated static analysis guard that eliminates this architectural risk.

JWT authentication is everywhere. It's also one of the most misconfigured security mechanisms.

One line of code can compromise everything.

The Vulnerable Code

// ❌ This looks fine...
const decoded = jwt.verify(token, secret, {
  algorithms: ["HS256", "none"], // 💀 The vulnerability
});

The Attack

// 1. Attacker takes a valid JWT:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTYiLCJyb2xlIjoidXNlciJ9.
signature_here

// 2. Modifies the header to use "none" algorithm:
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.
eyJzdWIiOiIxMjM0NTYiLCJyb2xlIjoiYWRtaW4ifQ.
// No signature needed!

// 3. Server accepts it because "none" is in algorithms list
// Attacker is now admin

Real CVEs

The Fix

// ✅ Explicitly whitelist algorithms
const decoded = jwt.verify(token, secret, {
  algorithms: ["HS256"], // Only what you use!
});

All JWT Vulnerabilities

1. Algorithm None

// ❌ Dangerous
jwt.verify(token, secret, { algorithms: ["none"] });

// ✅ Safe
jwt.verify(token, secret, { algorithms: ["HS256"] });

2. Algorithm Confusion

// ❌ Dangerous: RS256 token verified with symmetric secret
jwt.verify(token, publicKey);

// ✅ Safe: Explicit algorithm
jwt.verify(token, publicKey, { algorithms: ["RS256"] });

3. Weak Secret

// ❌ Dangerous: Brute-forceable
jwt.sign(payload, "password123");

// ✅ Safe: Strong secret
jwt.sign(payload, process.env.JWT_SECRET); // 256+ bits

4. Missing Expiration

// ❌ Dangerous: Token valid forever
jwt.sign({ userId: 123 }, secret);

// ✅ Safe: Short expiration
jwt.sign({ userId: 123 }, secret, { expiresIn: "1h" });

5. Sensitive Payload

// ❌ Dangerous: Password in token (tokens can be decoded!)
jwt.sign({ userId: 123, password: "secret" }, key);

// ✅ Safe: Only IDs
jwt.sign({ userId: 123 }, key);

ESLint Coverage

// eslint.config.js
import jwtPlugin from "eslint-plugin-jwt";

export default [jwtPlugin.configs.recommended];

13 JWT Rules

Error Messages

src/auth.ts
  15:3  error  🔒 CWE-347 CVSS:9.8 | JWT algorithm 'none' is allowed
               Risk: Attackers can forge tokens without a signature
               Fix: Remove 'none' from algorithms: ['HS256']

Quick Install

::dev-to-cta{url="https://npmjs.com/package/eslint-plugin-jwt in 60 seconds. 13 rules. Full JWT security. Zero false positives.**

📦 npm: eslint-plugin-jwt 📖 Rule: no-algorithm-none

⭐ Star on GitHub

The Interlace ESLint Ecosystem Interlace is a high-fidelity suite of static code analyzers designed to automate security, performance, and reliability for the modern Node.js stack. With over 330 rules across 18 specialized plugins, it provides 100% coverage for OWASP Top 10, LLM Security, and Database Hardening.

Explore the full Documentation

© 2026 Ofri Peretz. All rights reserved.

Build Securely. I'm Ofri Peretz, a Security Engineering Leader and the architect of the Interlace Ecosystem. I build static analysis standards that automate security and performance for Node.js fleets at scale.

ofriperetz.dev | LinkedIn | GitHub