JWT Missing Claim Validation

ID

csharp.jwt_missing_claim_validation

Severity

high

Remediation Complexity

low

Remediation Risk

high

Remediation Effort

low

Resource

Authentication

Language

CSharp

Tags

ASVS50:v13.3.1, CWE:287, NIST.SP.800-53, OWASP:2025:A07, PCI-DSS:6.5.10

Description

A JSON Web Token (JWT) is accepted without validating its iss (issuer) or aud (audience) claim.

The TokenValidationParameters disable ValidateIssuer or ValidateAudience.

Rationale

Verifying the token signature only proves that the token was signed with a trusted key; it does not prove that the token was intended for this application. When issuer or audience validation is turned off, the application accepts any validly-signed token regardless of who issued it or who it was minted for.

In multi-tenant or federated setups — several services trusting the same signing authority, or several applications sharing an identity provider — this lets an attacker present a token issued for a different application, tenant or audience and have it accepted here, an authentication bypass / token reuse across trust boundaries.

For example, in a multi-tenant Azure AD setup this lets a token issued for a different app registration be accepted:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuerSigningKey = true,
            ValidateIssuer = false,   // VULNERABLE: any issuer is accepted
            ValidateAudience = false, // VULNERABLE: any audience is accepted
        };
    });

Remediation

Keep issuer and audience validation enabled and configure the expected issuer(s) and audience(s), so tokens minted for anyone else are rejected. Only disable these checks when there is a deliberate, documented reason, never as a shortcut to make authentication "work".

ValidateIssuer and ValidateAudience are true by default; configure the expected ValidIssuer(s) and ValidAudience(s).

options.TokenValidationParameters = new TokenValidationParameters
{
    ValidateIssuerSigningKey = true,
    ValidateIssuer = true,             // FIXED
    ValidIssuer = "https://issuer.example.com",
    ValidateAudience = true,           // FIXED
    ValidAudience = "your_api_audience",
};

References