10. of Spoofing
An attacker can choose to use weaker or no authentication.
|
Threat |
|
|
|
An attacker can remove the signature algorithm from a JWT exploiting a “None Algorithm” vulnerability and allowing them to change a token and gain access to your systems. |
|
CAPEC |
CAPEC-620 - Drop Encryption Level |
|
ASVS |
3.5.3 - Ensure Null Cipher Checks are implemented |
|
CWE |
CWE-757 - Selection of Less-Secure Algorithm During Negotiation (‘Algorithm Downgrade’) CWE-345 - Insufficient Verification of Data Authenticity |
|
Mitigations |
|
|
|
|
