JWT Key Confusion Attack

JWT Key Confusion is another name for the JWT Algorithm Confusion attack: an asymmetric token (typically RS256) is switched to a symmetric algorithm (HS256) and the server's public key is reused as the HMAC secret to forge a valid signature. The two terms refer to the same RS256-to-HS256 technique and are used interchangeably.

Why the Two Names

The attack can be described from either angle: the attacker confuses the library about the algorithm (asymmetric to symmetric), which in turn causes it to confuse how the key is used (a verification public key treated as a signing secret). Both descriptions name the same flaw.

Not the Same As

Key Confusion is sometimes loosely stretched to cover any attack on how a library selects a verification key. Those are distinct, separately named issues rather than part of this attack:

• JWT Kid Injection: injection or path traversal via the kid header to point verification at an attacker-known key.
• JKU/X5U abuse: getting the server to fetch a JWKS or certificate from an attacker-controlled URL.

See Also

• JWT Algorithm Confusion Attack
• JWT Kid Injection
• JWT None Algorithm Attack
• JSON Web Token (JWT)