--- title: JWT Authentication Bypass leads to Admin Control Panel description: A simple JWT vulnerability allowed access to an admin panel on a well-known site. Although JWTs should be signed by a server for security, this example... canonical: https://daily.dev/posts/jwt-authentication-bypass-leads-to-admin-control-panel-xpymq7tri twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: JWT Authentication Bypass leads to Admin Control Panel | daily.dev og:description: A simple JWT vulnerability allowed access to an admin panel on a well-known site. Although JWTs should be signed by a server for security, this example... og:url: https://daily.dev/posts/jwt-authentication-bypass-leads-to-admin-control-panel-xpymq7tri og:image: https://api.daily.dev/og/posts/XPYMQ7TrI.png og:image:alt: JWT Authentication Bypass leads to Admin Control Panel og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # JWT Authentication Bypass leads to Admin Control Panel **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 3 min read · 34 upvotes · 1 comments ## Summary A simple JWT vulnerability allowed access to an admin panel on a well-known site. Although JWTs should be signed by a server for security, this example highlights how a minor mistake in implementation can lead to significant security breaches. The author used Burp Suite to identify and exploit the flaw, demonstrating how changes to JWT parameters can bypass authentication if the server's validation is flawed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@stalexlife** · 0 upvotes > Well nice demo but you should givr more explanation what fix could be done to avoid vulns --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#authentication](https://daily.dev/tags/authentication), [#jwt](https://daily.dev/tags/jwt) [View this post on daily.dev](https://daily.dev/posts/jwt-authentication-bypass-leads-to-admin-control-panel-xpymq7tri) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"JWT Authentication Bypass leads to Admin Control Panel","url":"https://daily.dev/posts/jwt-authentication-bypass-leads-to-admin-control-panel-xpymq7tri","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/jwt-authentication-bypass-leads-to-admin-control-panel-xpymq7tri"},"datePublished":"2024-10-27T23:31:48.747Z","dateModified":"2024-12-09T11:15:40.007Z","description":"A simple JWT vulnerability allowed access to an admin panel on a well-known site. Although JWTs should be signed by a server for security, this example...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6b3398aad23f89f0034f2a4af899710f?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6b3398aad23f89f0034f2a4af899710f?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"InfoSec Write-ups","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoSec Write-ups","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/f0dc21b5bbfd46fda36f7b4b53dd1705","url":"https://daily.dev/sources/infosecwriteups"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/jwt-authentication-bypass-leads-to-admin-control-panel-xpymq7tri","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":34},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,cyber,authentication,jwt","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":3,"name":"JWT Authentication Bypass leads to Admin Control Panel"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/jwt-authentication-bypass-leads-to-admin-control-panel-xpymq7tri","comment":[{"@type":"Comment","text":"Well nice demo but you should givr more explanation what fix could be done to avoid vulns","datePublished":"2024-12-22T19:26:28.905Z","url":"https://daily.dev/posts/XPYMQ7TrI#c-BI9MmVWVn","author":{"@type":"Person","name":"Steve A","url":"https://daily.dev/stalexlife","image":"https://avatars.githubusercontent.com/u/21204359?v=4"}}]} ```