JWT Psychic Signature

Severity	High
CVEs	CVE-2022-21449
Classifications	CWE-347: Improper Verification of Cryptographic Signature CAPEC-475: Signature Spoofing by Improper Validation
OWASP Category	OWASP API2:2023 Broken Authentication

The “JWT Psychic Signature” vulnerability (also known as the “Psychic Signature” attack, CVE-2022-21449) affects JWT verification code that uses a broken ECDSA implementation. An all-zero signature (r = 0, s = 0) is mathematically invalid, but affected implementations — notably Java 15 through 18 — accept it for any message and any public key. An attacker can therefore forge any ECDSA-signed token (ES256, ES384, ES512) without knowing the private key.

For more details, you can refer to the jwtop documentation on Psychic Signature.

Example

An application issues tokens signed with ES256. If it is vulnerable, an attacker can:

1. Take any header and payload (for example, one claiming "sub": "admin").
2. Set the signature segment to an encoding of r = 0, s = 0.
3. Send the forged token to the server.

The broken verifier returns “valid” and the server trusts the forged claims.

How to test?

If you want to test only the “JWT Psychic Signature” vulnerability, you can use the following command:

cURL

vulnapi scan curl [url] -H "Authorization: Bearer [JWT]" --scans jwt.psychic_signature

OpenAPI

echo "[JWT]" | vulnapi scan openapi [OpenAPI_Path_Or_URL] --scans jwt.psychic_signature

GraphQL

vulnapi scan graphql -H "Authorization: Bearer [JWT]" --scans jwt.psychic_signature [url]

This check only runs when the token under test uses an ECDSA algorithm (ES256, ES384, ES512) and a live server is available.

VulnAPI supports scanning against various types of other vulnerabilities as well.

What is the impact?

• Full Authentication Bypass: An attacker can forge tokens for any user, including administrative accounts.
• Account Takeover: Impersonating any user in the system without knowing any key.
• Unauthorized Access: Access to sensitive data and privileged functionality.

How to remediate?

• Patch the runtime: Update to a fixed JVM (Java 17.0.3 / 18.0.1 or later) or the fixed version of whatever crypto library performs ECDSA verification.
• Reject degenerate signatures: Ensure the verifier rejects signatures where r or s is zero or out of range.
• Strict Algorithm Enforcement: Always pin the expected algorithm(s) when verifying a JWT.
• Add test coverage: Include an all-zero-signature token in your authentication test suite.