JSON Web Token (JWT)
A compact, URL-safe token format with three base64-encoded segments: header, payload, and signature. Defined by RFC 7519. JWTs are the dominant format for ID tokens and bearer access tokens. Verify the signature; never trust unsigned JWTs.
JWTs are easy to produce and easy to verify wrongly, which is why they generate a steady stream of authentication bypasses: accepting alg: none, confusing HMAC and RSA verification, skipping the audience check, or trusting a kid that points at attacker-controlled key material. Use a maintained library, pin the expected algorithms, and validate issuer, audience, and expiry every time. A JWT is signed, not encrypted, so nothing secret belongs in the payload.
See also: claims, JWKS, access token, identity CVE catalog
Related on Start with Identity
- GlossaryID Token
A JWT issued by an OpenID Connect provider that conveys authentication claims about the user. Unlike access tokens, ID tokens are intended for the client, not f
- GlossaryRefresh Token
A longer-lived credential used to obtain new access tokens without re-authenticating the user. Refresh tokens should be one-time-use (rotated on each exchange)
- GlossaryOAuth 2.0
OAuth 2.0 is the standard authorization framework for delegated access. It lets a client obtain limited access to a resource owner's data without handling their
- CVESharePoint JWT validation chain, forge a token and become any user
Four weaknesses across two SharePoint JWT token handlers chain into an unauthenticated authentication bypass. Rapid7 published a proof of concept in August 2026
- BlogA CVSS 10.0 bug let one user's Terraform token serve another user's request
HashiCorp's Terraform MCP Server failed to assign unique session identifiers in stateless HTTP mode, so a token supplied by one user could be reused for later r
- BlogA SharePoint JWT validation bug let unauthenticated attackers become any user, including admins
CVE-2026-55040 (CVSS 9.1) let a remote, unauthenticated attacker who knows a target's Active Directory SID or user principal name forge a valid session as that