Listen to this Post
The vulnerability exists in Hono’s JWT middleware when using JWKS for key lookup. During JWT verification, the middleware retrieves a JSON Web Key (JWK) based on the token’s `kid` header. The algorithm (alg) for signature verification should be dictated solely by the trusted JWK’s `alg` parameter. However, if the retrieved JWK does not contain an explicit `alg` field, the middleware incorrectly falls back to using the unverified `alg` value from the JWT header itself. An attacker can exploit this by forging a JWT signed with a symmetric key (like HS256). They craft a token with `alg: HS256` and a `kid` pointing to an RSA-based JWK in the server’s JWKS that lacks an `alg` specification. The server retrieves the RSA public key but, due to the missing JWK alg, uses the attacker-provided HS256. It then uses the RSA public key as an HMAC secret to verify the HS256 signature. Since the public key is known, the attacker can create a valid HMAC signature, leading to token acceptance and potential authentication bypass.
Platform: Hono framework
Version: up to v4.6.4
Vulnerability : JWT algorithm confusion
Severity: Critical
date: 2025-04-15
Prediction: Patched v4.6.5
What Undercode Say:
curl -H “Authorization: Bearer
cat forged_jwt.json
{
“header”: {“alg”:”HS256″,”kid”:”rsa-key-without-alg”,”typ”:”JWT”},
“payload”: {“user”:”admin”,”exp”:9999999999}
}
openssl rand -base64 32
export SECRET=”public_key_pem_data”
node -e “console.log(require(‘jsonwebtoken’).sign({user:’admin’}, ‘$SECRET’, {algorithm:’HS256′, header:{kid:’target-key’}}))”
How Exploit:
1. Identify JWKS endpoint.
2. Find JWK without `alg`.
- Forge token using JWK’s public key as HMAC secret.
4. Sign with HS256 algorithm.
5. Inject token into authorization header.
Protection from this CVE
Update to Hono v4.6.5+. Explicitly set `alg` parameter in JWT middleware configuration. Mandate `alg` field in all deployed JWKs. Use strict allowlists for JWT algorithms.
Impact:
Authentication Bypass. Authorization Escalation. Forged Token Acceptance.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
