oidc-signing-alg-none-supported: OpenID Connect - Unsigned (alg none) ID Token Supported

2026-09-23 Unknown PoC Public

Description

The OpenID Connect discovery document advertises "none" among its id_token_signing_alg_values_supported, meaning the authorization server is willing to issue ID tokens with no signature. A relying party that accepts such a token cannot verify its integrity, enabling JWT "alg:none" forgery and authentication bypass. The "none" algorithm should never be offered for ID tokens in production.

PoC

id: oidc-signing-alg-none-supported

info:
  name: OpenID Connect - Unsigned (alg none) ID Token Supported
  author: rocky55ayush
  severity: medium
  description: |
    The OpenID Connect discovery document advertises "none" among its id_token_signing_alg_values_supported, meaning the authorization server is willing to issue ID tokens with no signature. A relying party that accepts such a token cannot verify its integrity, enabling JWT "alg:none" forgery and authentication bypass. The "none" algorithm should never be offered for ID tokens in production.
  reference:
    - https://openid.net/specs/openid-connect-discovery-1_0.html
    - https://datatracker.ietf.org/doc/html/rfc7518#section-3.6
    - https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 5.9
    cwe-id: CWE-347
  metadata:
    max-request: 3
  tags: oidc,openid,oauth,jwt,keycloak,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/openid-configuration"
      - "{{BaseURL}}/realms/master/.well-known/openid-configuration"
      - "{{BaseURL}}/auth/realms/master/.well-known/openid-configuration"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: word
        part: body
        words:
          - '"id_token_signing_alg_values_supported"'

      - type: regex
        part: body
        regex:
          - '"id_token_signing_alg_values_supported"\s*:\s*\[[^\]]*"none"'

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '"issuer"\s*:\s*"([^"]+)"'
# digest: 4a0a00473045022100d93c16ef9d6a3933b61720ed470bd6bb336e63f3882ac3154a0767ddb0c4b8e702202af1ba7a75c19772db218da2d02c6aa87cf20428f0faddf650bec87140cb6e76:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/oidc-signing-alg-none-supported.yaml