TRB-071v1.0.0 · jwt_weak_secret_unsupported_alg
JWT weak secret unsupported alg
JWT weak secret unsupported alg identifies credential material is exposed or relies on an insufficiently protected secret.
CWE mapping
CWE-798insufficient recognition
Assurance
The analyzer verified the reported property directly from the supplied input.
Conditional: Operational impact can still depend on where and how this value is used.
Inert example
Displayed as text only. tryb does not execute this example.
eyJhbGciOiJub25lIn0.eyJzdWIiOiIxMjMifQ.Remediation
inspect-context. The observed property needs destination-specific policy before an automatic rewrite is safe.
Verify: Inspect the actual consumer and encode the intended acceptance rule in a test.
What to verify next
Compare the finding with the destination system's validation and trust policy.