JWT No Validation (ARCH8126)

Key kotlin.security.jwt-no-validation · Severity error · Category security · CWE CWE-347

Flags JWTs decoded without signature verification (JWT.decode, parser without a signing key, verify skipped).

Incorrect

val claims = JWT.decode(token).claims

Correct

val claims = JWT.require(Algorithm.HMAC256(key)).build().verify(token).claims

Fix

Verify the signature and the expected issuer / audience before trusting any claim.