Description
The scanner detected missing validation of the jwk parameter in the header of a JSON Web Token (JWT). This parameter embeds a JSON Web Key (JWK) used to verify the token's signature. Without proper validation, an attacker can supply a malicious JWK, potentially allowing the creation of forged JWTs with arbitrary payloads. Attackers might be able to tamper with the values inside the JWT token payload and escalate privileges, impersonate users or trigger unintended application states that were meant to be prevented by the use of a tamper-proof token solution.
Remediation
To fix this vulnerability, disable support for the 'jwk' header parameter unless explicitly required. If support is necessary, implement strict validation to ensure the supplied JWK matches a trusted key source. The server-side code responsible for checking the JWT token should be audited and fixed in order to allow for the proper verification of the provided signature.