v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.py.jwt.algorithm-confusion

A JWT is decoded with an algorithms allowlist that mixes an HMAC algorithm with an asymmetric one.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

The list combines a symmetric HMAC algorithm (HS256/HS384/HS512) with an asymmetric one (RS/ES/PS). This enables the "algorithm confusion" attack: an attacker who knows your RSA/EC PUBLIC key can sign a forged token with HMAC, using that public key string as the shared secret. Because HS is also accepted, PyJWT verifies the forgery with the public key as the HMAC secret and treats it as valid: a complete authentication bypass.

Allow only ONE algorithm family, the one you actually use. If you issue RS256 tokens, pin jwt.decode(token, public_key, algorithms=["RS256"]) and never also accept an HS* algorithm with the same verification key.

CWE-327: Use of a Broken or Risky Cryptographic Algorithm.

VULNERABLE
vulnerable.py
import jwt


def decode_hs_then_rs(token: str, key: str):
    # ruleid: auth.py.jwt.algorithm-confusion
    return jwt.decode(token, key, algorithms=["HS256", "RS256"])


def decode_rs_then_hs(token: str, key: str):
    # ruleid: auth.py.jwt.algorithm-confusion
    return jwt.decode(token, key, algorithms=["RS256", "HS256"])


def decode_hs_and_es(token: str, key: str):
    # ruleid: auth.py.jwt.algorithm-confusion
    return jwt.decode(token, key, algorithms=["HS384", "ES256"])


def decode_hs_and_ps(token: str, key: str):
    # ruleid: auth.py.jwt.algorithm-confusion
    return jwt.decode(token, key, algorithms=["PS256", "HS512"])
SAFE
safe.py
import jwt


def decode_rs256_only(token: str, key: str):
    # ok: auth.py.jwt.algorithm-confusion
    return jwt.decode(token, key, algorithms=["RS256"])


def decode_hs256_only(token: str, secret: str):
    # ok: auth.py.jwt.algorithm-confusion
    return jwt.decode(token, secret, algorithms=["HS256"])


def decode_es256_only(token: str, key: str):
    # ok: auth.py.jwt.algorithm-confusion
    return jwt.decode(token, key, algorithms=["ES256"])


def decode_multiple_asymmetric(token: str, key: str):
    # ok: auth.py.jwt.algorithm-confusion
    return jwt.decode(token, key, algorithms=["RS256", "ES256"])

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.jwt.algorithm-confusion -- <reason>

References

https://cwe.mitre.org/data/definitions/327.html ↗https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ ↗