# fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

fast-jwt 6.2.4 classifies raw public JWK JSON as an HMAC secret, letting anyone who knows the public key forge HS256 tokens with arbitrary admin claims.

- Payout: Research
- Severity: high
- Program: fast-jwt
- Found by: the-vibe-dev
- Disclosed: 2026-10-08
- CVE: CVE-2026-107724
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-g3jj-5cmm-3hxx
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-g3jj-5cmm-3hxx
- Tags: area:oss domain:oss impact:ato impact:privesc kind:research platform:ghsa sev:high tech:jwt tech:nodejs technique:source-review vuln:auth-bypass vuln:crypto vuln:signature-replay

**Target:** npm JWT verification library (createVerifier key detection)
**Root cause:** performDetectPublicKeyAlgorithms() only recognizes PEM formats; any non-PEM non-empty string, including serialized public JWK/JWKS JSON, falls through to hsAlgorithms and is used verbatim as the HMAC key.
**Steps:**
1. Generate RSA keypair, export public key as JWK with kid/use/alg metadata, serialize to JSON string `rawJwk`
2. Sign HS256 token with claims `{"sub":"attacker","role":"admin","admin":true}` using `rawJwk` as HMAC secret
3. Verify with `createVerifier({ key: rawJwk, algorithms: ['HS256','RS256'] })` — accepted
4. Verify with `createVerifier({ key: rawJwk })` (auto-detect) — accepted
5. Control: `createVerifier({ key: rawJwk, algorithms: ['RS256'] })` — rejected
**How found:** Code review of src/crypto.js: noticed the PEM-detection branch treats every non-PEM string as a plain secret, then hypothesized that structured public JWK JSON would be silently reclassified as symmetric key material.
**Exploitation:** Attacker obtains the public JWK/JWKS JSON (often from discovery endpoints), reproduces the exact serialized bytes used as verifier key, and signs arbitrary HS256 claims with that JSON text as the HMAC secret; the verifier accepts the forged token as authentic.
**Escalation:** Forged claims can set admin roles, scopes, tenant IDs, or subject identifiers, yielding auth bypass and horizontal/vertical privilege escalation depending on claim usage.
**Insight:** When a library infers key type by format sniffing, feed it structured-but-non-matching formats (JWK/JWKS JSON, DER, base64) — any fall-through to 'assume symmetric secret' turns public key material into an attacker-known HMAC key.