JWT kid Header Injection

The optional kid (key ID) header tells the verifier which key to use. If the server feeds that attacker-controlled value into a file path, database query, or command without validation, the kid becomes an injection vector.

How it works

Path traversal. If the server loads keys/<kid>, a kid of ../../dev/null makes the key an empty/predictable file — sign your token with that known value and it verifies. On many systems /proc/sys/kernel/randomize_va_space or other predictable-content files are used as the "secret".

SQL injection. If kid is interpolated into SELECT key FROM keys WHERE id='<kid>', a UNION-based payload can return an attacker-chosen key.

How to test

Set kid to traversal payloads (../../../../dev/null), SQLi payloads, or command-injection strings, sign with the corresponding known/derived key, and observe whether verification succeeds.

Impact

Token forgery (bypass) and, with SQLi/command injection, potential data disclosure or RCE on the auth service.

Defenses

• Treat kid as an opaque lookup key against an allow-list — never a path, query fragment, or shell argument.
• Reject unknown kid values; parameterize any lookup.