The JWT Bug I Almost Walked Past : And Why Most Developers Still Get This Wrong
Researcher blog2026-10-31
Web
Not rated
BUG BOUNTY WRITEUPS
JWT writeups
JSON Web Token mistakes: weak signing, algorithm confusion, missing verification and tokens that never expire.
5 reports and writeups from 2024 to 2026. 2 carry a severity from the disclosing platform, 2 of them rated High or Critical. Last updated 2026-11-01.
Latest JWT reports
Search and filter all writeupsMimari Yanılgılar: APIM Key Sızıntısı ve Kısıtlanmamış JWT İle Zafiyet Zinciri (Vulnerability…
Medium2026-10-14
Web, API
Not rated
connect.8x8.com/api/v1: JWT Algorithm Confusion Vulnerability
HackerOne8x82026-07-22$1,337 bounty
Web, API
High
Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
HackerOneNextcloud2026-06-07$2,500 bounty
Web, Cloud
High
Plug Security Holes in React Apps That Can Lead to API Exploitation
Researcher blogSiemens2024-07-31
Web, API
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,817 items in total.