All Posts - Camilo Verdugohttps://cavg.github.io/posts/All Posts | Camilo VerdugoHugo -- gohugo.ioenThis work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.Mon, 06 Jul 2026 00:00:00 +0000Exploiting JSON Web Key (JWK)https://cavg.github.io/exploiting-jwk/Mon, 06 Jul 2026 00:00:00 +0000Camilo Verdugohttps://cavg.github.io/exploiting-jwk/JWTs are everywhere. They are the stateless session token of choice for modern web applications. But with great convenience comes a long tail of misconfigurations that turn a robust cryptographic standard into a wide-open door.

This post explores one of the more elegant attacks in the JWT ecosystem: JWK injection. By the end, you will understand how a misplaced trust in the jwk header parameter can let an attacker forge tokens at will, and — more importantly — how to shut it down.

]]>