🛡️ Security

Algorithm Confusion Attack

A JWT attack in which the verifier lets the token's header decide which algorithm to verify with, or fails to reject an algorithm it does not support, so an attacker-signed token passes the signature check. It is the class of bug behind the WSO2 API Manager bypass CVE-2026-5430.

📚 Deep Dive

Learn Article

How JWT Algorithm Confusion Lets a Forged Token Pass Signature Checks

A JWT verifier that lets the token choose the algorithm, or fails to reject one it does not recognize, will accept a token the attacker wrote. The failure shapes and what a correct verifier does.

intermediate 6 min read

Back to Glossary