JWT No Validation (ARCH7126)

Key php.security.jwt-no-validation · Severity error · Category security · CWE CWE-347

Decoding a JWT without verifying its signature (reading the payload directly or accepting alg: none) lets an attacker forge a token with any claims they want.

Incorrect

<?php
[$header, $payload, $sig] = explode('.', $token);
$claims = json_decode(base64_decode($payload), true); // signature not verified
$userId = $claims['sub'];

Correct

<?php
$claims = JWT::decode($token, new Key(getenv('JWT_KEY'), 'HS256')); // signature verified
$userId = $claims->sub;

Fix

Always verify JWTs with the expected algorithm and key; reject the none algorithm and unverified decoding.