Posts on: Authentication

---

JSON Web Token (JWT) is a format for transmitting cryptographically secure data, typically used as a stateless session token. The server verifies the token’s signature and then retrieves user information from the JWT claims. A JWT has three base64url-encoded parts separated by dots: <Base64_Header>.<Base64_Payload>.<Base64_Signature> Header — metadata, including the signing alg (algorithm) and optional key identifiers (kid, jwk, jku). Payload — the claims (registered and custom). Signature — computed over the header and payload using a key, per the algorithm in the header. If any part of the header or payload is modified, the signature no longer matches — unless the server’s verification logic is flawed. That is what every attack in this file targets: not the cryptography, but the verification code path.

OAuth is a standard designed to enable secure authorization between services and applications. It is widely used in Single Sign-On (SSO) scenarios, where a user can authenticate once and access multiple applications without sharing their credentials with each service. 2025–2026 context: OAuth 2.0/2.1 is now the backbone of almost every authentication system, and the vulnerability classes have moved out of the redirect_uri parameter and into the libraries that implement the flows. The current CVE feed is dominated by state-parameter persistence failures (Authlib, fastapi-sso), PKCE downgrade bypasses (Cloudflare workers-oauth-provider), OAuth email-linking account takeover (Pingvin Share, AshAuthentication), unauthenticated callback fallback (Feathers, CVSS 9.8), and dynamic client registration that accepts arbitrary redirect URIs.

Security Assertion Markup Language (SAML) is an XML-based standard for authentication and authorization between parties, widely used to implement Single Sign-On (SSO). Data is exchanged in digitally signed XML documents, and the security of the entire federation rests on one assumption: the element the Service Provider cryptographically verifies is the same element its application code reads the username from. 2025–2026 context: SAML is built on XML, and XML’s parser complexity has produced a persistent stream of critical authentication-bypass CVEs across every major language ecosystem. The 2025 PortSwigger “Fragile Lock” research introduced attribute pollution, namespace confusion, and Void Canonicalization as new XSW classes. The current CVE feed is dominated by signature wrapping in libraries (authentik, Net::SAML2, ruby-saml, Nokogiri), replay and missing Conditions validation (Casdoor, Logto, Snipe-IT, Keycloak), and XML comment injection (authentik).