---
title: "Discussion on \"JWT Attack Lab — Part 5: Path Traversal Through the kid Header\" | Hashnode"
description: "Discussion on \"JWT Attack Lab — Part 5: Path Traversal Through the kid Header\". The kid header tells a verifier which key to use — and it's attacker-controlled. Here's how that becomes path traversal, and full auth bypass."
url: "https://hashnode.com/posts/jwt-attack-lab-part-5-kid-injection/6a5b04620f6c2fac43da161b"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [JWT Attack Lab — Part 5: Path Traversal Through the kid Header](https://quietbytes.hashnode.dev/jwt-attack-lab-part-5-kid-injection?utm_source=hashnode&utm_medium=feed)

The kid header tells a verifier which key to use — and it's attacker-controlled. Here's how that becomes path traversal, and full auth bypass.

Jul 18 · 4 min read · quietbytes.hashnode.dev  
Read the article

-   [#jwt](https://hashnode.com/tag/jwt)
-   [#pathtraversal](https://hashnode.com/tag/pathtraversal)
-   [#appsec](https://hashnode.com/tag/appsec)
-   [#python](https://hashnode.com/tag/python)
-   [#flask](https://hashnode.com/tag/flask)

## Written by

[Renukashree Murali](https://hashnode.com/@quietbytes)

@quietbytes · Chennai, India

  
[View profile](https://hashnode.com/@quietbytes)

Building defensively. Thinking privately.

Cybersecurity graduate focused into privacy engineering and IAM. I write about the projects I build - what worked, what broke, and what I'd do differently. 👾

## Responses

Markdown supported · ⌘↵ to post

No responses yet.