Description

Detects cases where JWT tokens are decoded without proper signature verification, allowing attackers to tamper with token contents. Without verification, malicious users could modify the token payload or forge new tokens, potentially escalating privileges or impersonating other users.

Detection Strategy

• Identifies calls to jwt.decode() method in the code

• Checks if proper verification parameters are missing from the decode call

• Reports vulnerability when JWT token decoding is performed without signature validation or verification flags

• Specifically looks for decode() calls where the verify parameter is set to false or omitted

Vulnerable code example

import jwt from 'jsonwebtoken';

function verifyUserToken(token) {
    // VULNERABLE: jwt.decode() doesn't verify signature, allowing token tampering
    const decoded = jwt.decode(token);
    return decoded;
}

✅ Secure code example

import jwt from 'jsonwebtoken';

function verifyUserToken(token) {
    // Safe: jwt.verify() validates signature and throws if token is invalid
    const secretKey = process.env.JWT_SECRET_KEY;
    try {
        const decoded = jwt.verify(token, secretKey, {
            algorithms: ['HS256'] // Explicitly specify allowed algorithms...