JWT alg:none
Algorithm set to none so unsigned tokens are accepted
categoryWeb and application attacksseverityVery Highlabnot yet measured
Classification
17 values: 8 reviewed, 8 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | Software vulnerabilities |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | Medium |
| Maturity | Legacy / declining |
Impact & scope
| Severity | Very High |
|---|---|
| Impact | AvailabilityConfidentialityIntegrity |
| Environment | CloudOn-premises |
| Target asset class | IdentityWeb app / API |
Detection & response
No linked mitigations or detections yet.
Framework references
- Primary source: https://portswigger.net/web-security/jwt
- cve: CVE-2015-9235 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Web and application attacks' table, line 281 of Cyber-Attack-Taxonomy.md
- ev-0002 (FIRST EPSS scores) — FIRST EPSS for CVE-2015-9235: epss=0.08655 percentile=0.94861 (score date 2026-09-18).
- ev-0003 (NVD CVE API 2.0) — NVD maps CVE-2015-9235 to weakness(es) CWE-20, CWE-327.