JWT kid injection to path traversal or SQL

Jul 23, 2026 · 1 min read

If the server uses kid to look up the signing key, it may read a file or query a table. Point kid at a predictable file whose contents you control, then sign with that.

json

{"alg":"HS256","kid":"../../../../dev/null"}

With kid pointing at an empty or known file, sign with that known value (empty string for /dev/null).

bash

# HMAC key becomes the empty file contents; sign with empty secret
jwt_tool eyJ... -S hs256 -p ""

Pro note: if kid feeds a SQL lookup, inject a UNION that returns a key you control, then sign with it. Test both file and DB backends; the header value is attacker controlled and rarely sanitized because developers treat it as an internal identifier.