JWT JKU Header Injection

Severity	High
Classifications	CWE-346: Origin Validation Error CAPEC-194: Fake the Source of Data
OWASP Category	OWASP API2:2023 Broken Authentication

The “JWT JKU Header Injection” vulnerability occurs when a server reads the jku (JWK Set URL) header from an incoming token, fetches the JWKS document at that URL, and uses it to verify the signature. Because the attacker controls the header, they can point jku at a server they own that serves an attacker-generated public key. This is also a Server-Side Request Forgery primitive, since the target makes an outbound request to an attacker-chosen URL.

For more details, you can refer to the jwtop documentation on JKU Injection.

Example

1. The attacker hosts a JWKS document containing their own public key.
2. They build a token with the desired claims and a header "jku": "https://attacker.example/jwks.json".
3. They sign it with the matching private key.
4. The server fetches the attacker’s JWKS, verifies the signature against it, and accepts the token.

How to test?

If you want to test only the “JWT JKU Header Injection” vulnerability, you can use the following command:

cURL

vulnapi scan curl [url] -H "Authorization: Bearer [JWT]" --scans jwt.jku_injection

OpenAPI

echo "[JWT]" | vulnapi scan openapi [OpenAPI_Path_Or_URL] --scans jwt.jku_injection

GraphQL

vulnapi scan graphql -H "Authorization: Bearer [JWT]" --scans jwt.jku_injection [url]

This check requires a live target that can reach a callback server run by the scanner, so it only runs when the token uses an asymmetric algorithm and a reachable callback address has been configured.

VulnAPI supports scanning against various types of other vulnerabilities as well.

What is the impact?

• Full Authentication Bypass: An attacker can forge tokens for any user, including administrative accounts.
• Server-Side Request Forgery: The target can be coerced into making outbound requests to attacker-chosen URLs.
• Account Takeover: Impersonating any user in the system.

How to remediate?

• Ignore token-supplied URLs: Never fetch keys from the jku or x5u header. Use a key set configured out of band.
• Allowlist key endpoints: If dynamic key retrieval is required, validate jku against a strict allowlist of known, trusted URLs.
• Strict Algorithm Enforcement: Always pin the expected algorithm(s) when verifying a JWT.