A JWT is decoded but its signature is never verified.

Why this matters

Auth0 java-jwt's JWT.decode(token) only base64-decodes the token (it does NOT check the signature), so any claim it exposes (subject, roles, expiry) is fully attacker-controlled (CWE-345). This is a common AI-generated mistake: JWT.decode(...) is reached for to "read the claims" and its result is trusted as if it had been verified.

Verify the signature before reading any claim. With Auth0 java-jwt build a verifier and call it: JWT.require(Algorithm.HMAC256(secret)).withIssuer(iss).withAudience(aud).build().verify(token) The DecodedJWT returned by verify(...) is the only trustworthy one.

import com.auth0.jwt.JWT

fun currentUser(token: String): String {
    // ruleid: auth.kotlin.jwt.decode-without-verify
    val decoded = JWT.decode(token)
    return decoded.getClaim("sub").asString()
}

fun isAdmin(token: String): Boolean {
    // ruleid: auth.kotlin.jwt.decode-without-verify
    return JWT.decode(token).getClaim("role").asString() == "admin"
}

import com.auth0.jwt.JWT
import com.auth0.jwt.algorithms.Algorithm

fun currentUser(token: String): String {
    val verifier = JWT.require(Algorithm.HMAC256(System.getenv("JWT_SECRET")))
        .withIssuer("https://idp.example.com")
        .withAudience("my-api")
        .build()
    val decoded = verifier.verify(token)
    return decoded.getClaim("sub").asString()
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.kotlin.jwt.decode-without-verify -- <reason>

References