mcp-server-semgrep/semgrep-rules/python/jwt/security/unverified-jwt-decode.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: unverified-jwt-decode
  patterns:
    - pattern-either:
        - patterns:
          - pattern: |
              jwt.decode(..., options={..., "verify_signature": $BOOL, ...}, ...)
          - metavariable-pattern:
              metavariable: $BOOL
              pattern: |
                False
          - focus-metavariable: $BOOL
        - patterns:
            - pattern: |
                $OPTS = {..., "verify_signature": $BOOL, ...}
                ...
                jwt.decode(..., options=$OPTS, ...)
            - metavariable-pattern:
                metavariable: $BOOL
                pattern: |
                  False
            - focus-metavariable: $BOOL
  message: >-
    Detected JWT token decoded with 'verify=False'. This bypasses any integrity
    checks for the token which means the token could be tampered with by
    malicious actors. Ensure that the JWT token is verified.
  metadata:
    owasp:
    - A02:2017 - Broken Authentication
    - A07:2021 - Identification and Authentication Failures
    cwe:
    - 'CWE-287: Improper Authentication'
    references:
    - https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96
    category: security
    technology:
    - jwt
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
  fix: |
    True
  severity: ERROR
  languages:
  - python