Mike Jones
- Co-author and editor of OAuth 2.0 (RFC 6749) supporting documents
- Lead author of JSON Web Token (RFC 7519) and related JOSE specifications
- Co-editor of OpenID Connect Core 1.0
Bio
Mike Jones is one of the most prolific contributors to modern identity standards. His name appears as author or editor on the JSON Web Token (RFC 7519), JSON Web Signature, JSON Web Encryption, and JSON Web Key specifications. Long career at Microsoft where he led identity standards work before becoming an independent consultant.
Notable contributions
Lead author or editor on the JOSE specification suite (JWT, JWS, JWE, JWK). Co-editor of OpenID Connect Core. Active contributor to OAuth working group specifications across two decades.
Profile built from public IETF and OpenID Foundation records. Corrections welcome.
Where their work shows up
The specifications carrying his name are the ones almost every modern identity system depends on: JWT (RFC 7519), JSON Web Signature, JSON Web Encryption, and JWKS. Those formats underpin OpenID Connect ID tokens and most access tokens, which is also why JWT validation errors are a recurring class in our identity CVE catalog.
Related on Start with Identity
- GlossaryOpenID Connect (OIDC)
OpenID Connect is an authentication layer built on top of OAuth 2.0. Where OAuth tells you what a token is authorized for, OIDC tells you who the user is via a
- CVEWordPress OAuth SSO plugin JWT bypass, admin takeover
The OAuth SSO WordPress plugin through 6.26.12 failed JWT signature verification. A forged token becomes an administrator. Patched in 6.26.13.
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- CVEAuth0 node-jws HS256 verification bypass via secret lookup
node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.