VRT New Vulnerability Addition Request - JWT Misconfigurations

[prithvi1337]

I would like to propose the inclusion of the following vulnerabilities in the Vulnerability Rating Taxonomy (VRT), as incorporating them will enhance its comprehensiveness and accuracy.

• Broken Authentication and Session Management -> JWT Misconfigurations-> alg: none accepted (no signature verification) -> P1

• Broken Authentication and Session Management -> JWT Misconfigurations -> Algorithm Confusion (RS256 →HS256) -> P2

• Broken Authentication and Session Management -> JWT Misconfigurations -> Key Confusion/key reuse -> P3

Please let me know if any additional information or justification is required. Looking forward to your feedback

[TimmyBugcrowd]

Hi @prithvi1337,

Thanks for the suggestion. These JWT misconfigurations are well-known and largely mitigated by default in modern libraries. Their presence typically indicates outdated or insecure custom implementations rather than common real-world scenarios.

Including them as standalone entries could overcomplicate the VRT. For now, they can be covered under existing category Authentication Bypass.

Let us know what your thoughts are!

[prithvi1337]

Hi @TimmyBugcrowd,

Thanks for the response. I understand the concern about overcomplicating the VRT, but I still believe having more specific entries for JWT misconfigs could improve reporting accuracy and reduce ambiguity for both researcher and triager.
I hope we can add it to the agenda for the next VRT meeting.

Thanks.