domains / families / security / jwt-oauth-token-attacks

jwt-oauth-token-attacks

separate

JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses.

When to use

• JWT cryptographic attacks
• OAuth flow attacks
• PKCE bypass
• token leakage via Referer/logs
• validating token trust
• signing algorithm validation
• key handling validation
• claim abuse validation

When not to use

• redirect URI validation
• state validation
• nonce validation
• PKCE validation
• account-binding validation
• browser-readable APIs cross-origin
• enterprise SSO outside OAuth/OIDC

Skill page

Source