v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.rust.jwt.algorithm-confusion

A jsonwebtoken Validation accepts both HMAC and asymmetric algorithms, enabling algorithm confusion.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

The accepted-algorithm list MIXES an HMAC family (Algorithm::HS256/HS384/HS512) with an asymmetric family (Algorithm::RS*/ES*/PS*). When both families are accepted, an attacker takes your RSA/EC PUBLIC key (which is not secret) and signs a forged token with HS*, using the public key bytes as the HMAC shared secret. decode then verifies that forged token as valid, letting the attacker mint arbitrary identities and claims.

Pin validation.algorithms to a SINGLE family you actually use, e.g. validation.algorithms = vec![Algorithm::RS256]; when your issuer signs with RSA, or vec![Algorithm::HS256] for a genuinely symmetric secret. Never accept an HMAC algorithm alongside an asymmetric one.

CWE-327: use of a broken or risky cryptographic algorithm/configuration.

VULNERABLE
vulnerable.rs
use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation};
use serde::Deserialize;

#[derive(Debug, Deserialize)]
struct Claims {
    sub: String,
    exp: usize,
}

// Field assignment mixing an HMAC and an RSA algorithm.
fn decode_field_mixed(token: &str, key: &DecodingKey) -> Claims {
    let mut validation = Validation::new(Algorithm::HS256);
    // ruleid: auth.rust.jwt.algorithm-confusion
    validation.algorithms = vec![Algorithm::HS256, Algorithm::RS256];
    decode::<Claims>(token, key, &validation).unwrap().claims
}

// Asymmetric listed first, HMAC second — still confusion.
fn decode_field_mixed_reordered(token: &str, key: &DecodingKey) -> Claims {
    let mut validation = Validation::new(Algorithm::ES256);
    // ruleid: auth.rust.jwt.algorithm-confusion
    validation.algorithms = vec![Algorithm::ES256, Algorithm::HS384];
    decode::<Claims>(token, key, &validation).unwrap().claims
}

// `Validation::new(...)` plus a mixed `set_algorithms` list.
fn decode_set_algorithms_mixed(token: &str, key: &DecodingKey) -> Claims {
    let mut validation = Validation::new(Algorithm::HS512);
    // ruleid: auth.rust.jwt.algorithm-confusion
    validation.set_algorithms(vec![Algorithm::PS256, Algorithm::HS512]);
    decode::<Claims>(token, key, &validation).unwrap().claims
}
SAFE
safe.rs
use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation};
use serde::Deserialize;

#[derive(Debug, Deserialize)]
struct Claims {
    sub: String,
    exp: usize,
}

// ok: auth.rust.jwt.algorithm-confusion -- single asymmetric family
fn decode_rsa_only(token: &str, key: &DecodingKey) -> Claims {
    let mut validation = Validation::new(Algorithm::RS256);
    validation.algorithms = vec![Algorithm::RS256];
    decode::<Claims>(token, key, &validation).unwrap().claims
}

// ok: auth.rust.jwt.algorithm-confusion -- single HMAC family
fn decode_hmac_only(token: &str, key: &DecodingKey) -> Claims {
    let mut validation = Validation::new(Algorithm::HS256);
    validation.algorithms = vec![Algorithm::HS256];
    decode::<Claims>(token, key, &validation).unwrap().claims
}

// ok: auth.rust.jwt.algorithm-confusion -- multiple asymmetric variants, no HMAC
fn decode_asymmetric_multi(token: &str, key: &DecodingKey) -> Claims {
    let mut validation = Validation::new(Algorithm::RS256);
    validation.set_algorithms(vec![Algorithm::RS256, Algorithm::ES256]);
    decode::<Claims>(token, key, &validation).unwrap().claims
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.rust.jwt.algorithm-confusion -- <reason>

References

https://cwe.mitre.org/data/definitions/327.html ↗https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ ↗