A county API verifies JWTs poorly, including accepting tokens that declare insecure algorithm handling. What vulnerability class theme applies?
Select an answer to reveal the explanation.
Short Explanation
A badge reader that believes any sticker saying "signed" is not a badge reader. Weak JWT checks — including bad algorithm handling — let forged claims slide. Stay on the misconfig class; no need for exploit recipes.
Full Explanation
JSON Web Token flaws often stem from failing to enforce expected algorithms, verify signatures with trusted keys, or validate claims such as audience and expiry. Improper validation can allow privilege escalation or impersonation. Remediation uses well-reviewed libraries with strict verification settings. Conceptual reporting is enough for CPTS-style MCQ; unrelated network or robots issues do not apply.