algorithm-confusion

Here are 3 public repositories matching this topic...

vrajbhai / JWToken-analyzer

A browser-based JWT security toolkit that decodes, audits, brute-forces weak secrets, forges tampered tokens, and simulates real-world attacks — with instant Python/PyJWT fix code generation.

security jwt cryptography cybersecurity brute-force pentesting jwt-security pyjwt token-security jwt-analyzer algorithm-confusion

Updated Mar 22, 2026
HTML

Zeeshanafridai / jwt-attack-suite

Star

A comprehensive JWT attack CLI covering every major vulnerability class — from alg:none bypass to RS256→HS256 algorithm confusion, HMAC secret bruteforce, kid header injection (SQLi + path traversal), jku/x5u spoofing with built-in JWKS server, and full token forgery. Built for bug bounty hunters and red teamers.

jwt web-security json-web-token jwt-security penetration-testing-tools bug-bounty-tools jwt-attacks token-forgery algorithm-confusion

Updated Aug 2, 2026
Python

fixedbyreboot / CVE-2026-11800-POC

Star

POC for CVE-2026-11800 - JWT algorithm confusion in Keycloak identity brokering: the IdP RSA public key DER bytes are accepted as an HMAC secret, minting tokens for federated users without any private key. Vulnerable 26.6.3 vs fixed 26.6.4, mitigation notes included.

python java security jwt keycloak exploit poc sso vulnerability cve auth-bypass algorithm-confusion

Updated Nov 10, 2026
Python

Add this topic to your repo

To associate your repository with the algorithm-confusion topic, visit your repo's landing page and select "manage topics."

Learn more