Description
The scanner detected a missing validation of the 'jku' parameter in a JSON Web Token's header. This parameter specifies the location of the JSON web key set (JWKS) used to verify the token's signature. Without proper validation, an attacker can supply a JWKS, potentially allowing the creation of forged JWTs with arbitrary payloads. Additionally they may be able to trigger a blind SSRF attack.
Remediation
In order to fix this vulnerability, you need to implement a whitelist of URLs that are allowed to host a JWKS file, specified in the 'jku' header parameter. To make sure it is resilient to validation bypasses, please make sure to validate the full URL and disable HTTP redirection for the HTTP library responsible for the token retrieval.