JWT 'kid' Parameter Flaw Enables SQL Injection and Path Traversal Attacks

A security vulnerability in how servers process the JSON Web Token 'kid' header parameter allows attackers to manipulate key selection without breaking cryptography. Because the RFC defines no required format or character restrictions for 'kid', most libraries pass the raw value directly to database queries or file reads without sanitization. In the SQL injection variant, an attacker injects a UNION payload to make the server use an attacker-chosen HMAC key, then re-signs a forged token that passes verification. In the path traversal variant, injecting a sequence like '../../../../dev/null' causes the server to read an empty file, letting the attacker sign tokens with a predictable null-byte key. The vulnerability is rated CVSS 7.5 High, requires no prior authentication, and fully compromises authentication integrity.