Cybersecurity glossary
What is JWT kid Injection?
Learn what JWT kid injection is, how attackers abuse the key ID header to point verifiers at attacker keys or files, real impact scenarios, and safe kid handling patterns.
Definition
JWT kid injection is an attack that manipulates the JSON Web Signature kid (key ID) header parameter so a verifier resolves or loads attacker-influenced key material—via path traversal, SQL injection, URL fetch, or unconstrained key maps—allowing forged tokens to validate.
Why kid injection matters
Key rotation needs a selector. The JOSE kid header provides one—but it is attacker-controlled input until verification succeeds. JWT kid injection abuses naive key loaders that turn that selector into a path, query, or remote fetch.
When it works, attackers do not break cryptography; they make the application verify against a key they already control.
Injection patterns to watch for
Filesystem path concatenation
kid values like ../../keys/attacker.pem traverse into unexpected key files.
SQL or template injection
Dynamic queries build key lookup strings directly from kid.
Remote key URLs
jku/x5u plus kid send verifiers to attacker-hosted JWKS documents.
Unconstrained in-memory maps
Services auto-learn keys from tokens instead of an allowlisted set.
How a kid injection attack progresses
Study key resolution code or behavior
Infer whether kid influences files, queries, or remote discovery.
Prepare attacker key material
Generate a key pair or secret the vulnerable resolver can be pointed to.
Craft a malicious kid
Encode traversal, injection, or attacker key identifiers in the header.
Sign with the attacker key
Produce a token whose signature matches the injected key.
Submit to the verifier
The service resolves kid unsafely and validates using attacker material.
Exercise privileged APIs
Forged claims are trusted because the signature “checks out.”
Safe vs unsafe kid handling
| Pattern | Verdict | Reason |
|---|---|---|
| Exact match into cached JWKS | Safe | kid only selects among trusted published keys |
| kid concatenated into file path | Unsafe | Enables traversal and arbitrary key file read |
| Fetch JWKS from token jku | Unsafe by default | Attacker can host verification keys |
| Unknown kid rejected | Safe | Forces rotation through controlled publication |
Defenses against kid injection
- Resolve kid only via exact lookup in an allowlisted JWKS or key map.
- Never interpolate kid into filesystem paths, URLs, or SQL/LDAP queries.
- Ignore or strictly pin jku/x5u; prefer configured issuer metadata.
- Reject tokens with unknown kids instead of attempting creative resolution.
- Sanitize is not enough—avoid putting kid into interpreters altogether.
- Include traversal and URL-based kid payloads in security tests.
- Log kid values for telemetry without reflecting them into key loaders.
- Review API gateway JWT key-resolver plugins for dynamic fetch features.
The practical takeaway
JWT kid injection turns a helpful key selector into a key-loading exploit. The fix is architectural: treat kid as an opaque lookup token into keys you already trust.
Publish keys through JWKS, match exactly, reject unknowns, and keep headers away from filesystems and open URL fetches.
Related security terms
JSON Web Key Set (JWKS)
The usual allowlisted source from which kids should resolve.
JSON Web Key (JWK)
Individual keys selected by kid during verification.
JWT Algorithm Confusion
Related verification-policy failures often chained with kid tricks.
JSON Web Token (JWT) Attacks
Broader set of JWT validation abuses.
Directory Traversal
A common impact when kid is concatenated into filesystem paths.
Frequently asked questions
What is the kid parameter?
kid stands for key ID. It is an optional header field that helps a verifier pick which key to use when multiple keys are available.
What is JWT kid injection in simple terms?
Attackers change the kid value to trick the server into loading the wrong key—sometimes their own key—so a forged token looks correctly signed.
Is using kid insecure by itself?
No. kid is safe when it is only a lookup key into a trusted JWKS or key map. It becomes dangerous when applications treat it as a path, SQL fragment, or remote URL.
What are common kid injection payloads?
Examples include path traversal sequences, SQL quotes, or kids that cause the app to fetch keys from attacker-controlled jku/x5u locations.
How should servers resolve kid?
Exact-match lookup against an allowlisted in-memory or JWKS key set. Reject unknown kids. Never interpolate kid into filesystem or database queries.
Can gateways be affected?
Yes. API gateways and JWT middleware with custom key resolvers are frequent sources of unsafe kid handling.
Does rotating keys require kid?
kid is the practical way to support overlapping keys during rotation, provided selection stays constrained to published JWKS entries.
References
Explore authoritative guidance and frameworks related to jwt kid injection.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.