jsonwebtoken verify without the algorithms option
Rule ID: vetkit.js.jwt.verify-without-algorithms
jsonwebtoken verify is called without the algorithms option, so the accepted algorithms are inferred from the key. With an empty or unset secret (for example a missing environment variable) versions before 9 then accept unsigned none tokens, and a key object or a public key that is not PEM-encoded is treated as an HMAC secret (algorithm confusion).
Last updated:
Suite: Security
javascript, typescript
jsonwebtoken verify is called without the algorithms option, so the accepted algorithms are inferred from the key. With an empty or unset secret (for example a missing environment variable) versions before 9 then accept unsigned none tokens, and a key object or a public key that is not PEM-encoded is treated as an HMAC secret (algorithm confusion).
Category: SECURITY · Engine rule severity: INFO
How to fix it
Pass algorithms with exactly the algorithm(s) the tokens are signed with, e.g. jwt.verify(token, key, { algorithms: ['RS256'] }), and fail fast when the key is missing.
References
Source: packages/engine/rules/sast/javascript.yml.
Related checks
- JWT jwt.decode() trusted without signature verification
- JWT hardcoded secret in jsonwebtoken sign or verify
- JWT verify with ignoreExpiration: true accepts expired tokens
- JWT verify accepts the none algorithm
- NextAuth allowDangerousEmailAccountLinking enabled
- NextAuth Auth.js debug: true logs tokens in production
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.