Invicti detected that the application is vulnerable to the Json Web Tokens (JWT) “jku” header signature bypass through an open redirect.

By changing the value of the jku parameter in the header, an attacker can force the application to utilize a malicious JWT and bypass the signature. If URL filtering is in place within the application an attacker might chain this attack with an open redirect to bypass URL filtering and forge their own signature.

The application has to have the list of allowed hosts and have correct URL filtering in place. Also, the application must not contain other vulnerabilities that an attacker can chain to bypass URL filtering such as:

• Open redirect
• Header Injection
• SSRF