A JWT bearer setup disables signature validation (ValidateIssuerSigningKey = false) on TokenValidationParameters.

Why this matters

With the signing key unchecked, a token carrying any signature (or none) is accepted, so an attacker can forge a token for any user or role (CWE-347). This is a frequent AI-generated shortcut: validation is turned off to get past a local key-setup error and never turned back on.

Leave ValidateIssuerSigningKey at its secure default (true) and supply the real key via IssuerSigningKey / IssuerSigningKeys, loaded from the OIDC metadata or configuration rather than hard-coded.

using Microsoft.IdentityModel.Tokens;

public class Startup
{
    public void ConfigureAuth()
    {
        var tvp = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            // ruleid: auth.csharp.jwt.validate-signing-key-disabled
            ValidateIssuerSigningKey = false,
        };
    }
}

using Microsoft.IdentityModel.Tokens;

public class Startup
{
    public void ConfigureAuth()
    {
        var tvp = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = LoadKeyFromConfig(),
        };
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.jwt.validate-signing-key-disabled -- <reason>

References