# Token checks skipped: signature, scope, credential

Token decoded but signature, scope, or core grant credential never verified before trust

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; latest 2026-10-27. Updated 2026-11-02._

## How it works
A token is trusted because it *looks* valid, not because it was *proven* valid. The verifier decodes the token, reads its claims, and acts on them — but skips one of the checks that make those claims meaningful: the signature (is this really from the issuer?), the scope (is this token allowed to do this?), or the grant's core credential (was the device_code/code actually issued?). The broken assumption is "a well-formed token is an authentic, authorized token." Anyone who can produce or obtain a well-formed token — by minting one, by getting a low-privilege one, or by omitting a required parameter — crosses the user boundary.

## Where it shows up
- JWT decode calls (`decode`, `parseClaims`, base64 payload split) with no `verify`/JWKS fetch nearby [E2](https://bugbountylibrary.com/r/h1%3A2536758.md).
- Token-exchange or token-endpoint handlers that check `iss`/signature but never compare `scope`/`aud` to the requested privilege [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md).
- Grant `validate_token_request` implementations that omit presence/validity checks on their core credential [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-3jp2-3mrg-2vxc.md).
- Auth endpoints reachable via path variants (trailing slash, case, encoding) that skip the anonymous-access-disabled gate [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md).

## How to review
For every token consumer, name the exact property that must hold and confirm the code enforces it:
- **Signature:** claims are only trusted after verification against the issuer's published keys (JWKS), fetched and matched [E2](https://bugbountylibrary.com/r/h1%3A2536758.md).
- **Scope/audience:** the token's granted scope is compared to the privilege of the operation, not just its signature/issuer [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md).
- **Core credential:** each grant validates the credential it is supposed to redeem (device_code, code, refresh) as mandatory and valid before issuing anything [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-3jp2-3mrg-2vxc.md).
- **Gate parity:** every path variant of an auth endpoint hits the same access check [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md).
If any of these is absent, the token is attacker-controlled input, not proof of identity.

## How finders spotted it
- Source review found the JWT decoded but signature never checked; a recent commit had removed a role restriction, widening impact [E2](https://bugbountylibrary.com/r/h1%3A2536758.md).
- Compared `DeviceCodeGrant.validate_token_request` against `AuthorizationCodeGrant`'s, which validates its code; the device_code equivalent was missing, and RFC 8628 makes it mandatory [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-3jp2-3mrg-2vxc.md).
- Telemetry showed 401-then-200 on token path variants and anonymous identity minting tokens [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md).

## Variants seen
- Unsigned JWT accepted at a third-party IdP register/login endpoint [E2](https://bugbountylibrary.com/r/h1%3A2536758.md).
- Signature/issuer checked but scope not, allowing low-priv token exchange for admin [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md).
- Anonymous token leaked via trailing-slash path variant [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md).
- Grant handler omits validation of its core credential [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-3jp2-3mrg-2vxc.md).

## Impact and severity
Reached admin tokens and persistent admin accounts, malicious plugins, and backdoors [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md); full WordPress takeover via Admin/Editor hijack and bulk-registration DoS [E2](https://bugbountylibrary.com/r/h1%3A2536758.md); bearer token issuance without a valid device code [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-3jp2-3mrg-2vxc.md). Impact rose when the anonymous token leak was chained with the scope bypass [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md), and when a prior role restriction had been removed [E2](https://bugbountylibrary.com/r/h1%3A2536758.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201.md
- E2: https://bugbountylibrary.com/r/h1%3A2536758.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-3jp2-3mrg-2vxc.md