I'm currently learning about a vulnerability that takes advantage of a JSON web token which is discussed here

Though I understood the nature of the bug and how it can be abused by attackers, I couldn't figure out how to exploit it. I have read many articles about it and came across a URL which can be used to test this vulnerability for educational purposes. (You can find the two links for testing below.

JSON security

Public key

Does anyone have any thoughts on how I can exploit this?

  • can anyone please shower your interest here?.
    – Gowtham
    Jun 6, 2018 at 8:58

1 Answer 1


Finally I bypassed it with custom JWT algorithm, where HMAC accepts public key as its secret key. Which cannot be done in python's pyjwt module or any other language since it is fixed.

Check out POC code here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .