JWT without validation (ARCH2126)

Key python.security.jwt-no-validation · Severity error · Category security · CWE CWE-347

Decoding a JWT with signature verification off (verify_signature=False) lets an attacker freely alter claims and forge tokens. This bypasses authentication entirely.

Incorrect

import jwt

claims = jwt.decode(token, options={"verify_signature": False})
user_id = claims["sub"]

Correct

import jwt

claims = jwt.decode(token, key, algorithms=["RS256"],
                    audience="api", options={"require": ["exp", "sub"]})
user_id = claims["sub"]

Fix

Always validate JWTs with the signature, algorithm, and required claims; never use verify_signature=False.