Yes. JWT also had a bug where some implementations would use the pubkey as an hmac password if you switched the algorithm which is similarly bad.

Specifying the algorithm in the attacker controlled document is a bad design imo.

Still i feel like SAML is much worse. JWT has a few rough edges, but SAML its like everything.

▲

patmorgan23 12 hours ago | parent [-]

Yeah, the standard should have just specified like a sha256 HMAC, when that becomes broken in 20 years we can just do a JWT2 (or invent some new successor standard)

	▲	bawolff 11 hours ago \| parent [-]
		given that md5-hmac isn't even broken despite md5 being broken, it seems unlikely sha256-hmac will fall in 20 years. that said, algorithm agility isn't the primary issue, its whether you want symmetric (hmac) or asymmetric (digital signature). Both have advantages and disadvantages so there is no per-se right answer, it depends on context.