Auth & Tokens
- JWT header injection via jku and x5u If the verifier fetches the key from a URL in the token header, point it at your own JWKS and sign with your matching key.
- JWT algorithm confusion, RS256 to HS256 A generic verify that does not pin the algorithm lets you sign HS256 tokens using the RSA public key as the HMAC secret.