A lot of people are talking about the "none" algorithm issue, but the more recent vulnerability[0] is more telling: The report to the working group mailing list

A lot of people are talking about the "none" algorithm issue, but the more recent vulnerability[0] is more telling: The report to the working group mailing list[1] led to the point that the standard had a "security considerations" section in the RFC, and this particular issue was never covered. And now there are difficulties around the fact they cannot update an RFC which people will refer to for years. It's not a vulnerability in one or two libraries - it looks like just about every made the same mistake, which points to something much more broken. [0] https://auth0.com/blog/critical-vulnerability-in-json-web-encryption https://auth0.com/blog/critical-vulnerability-in-json-web-en... [1] https://www.ietf.org/mail-archive/web/jose/current/msg05613.html https://www.ietf.org/mail-archive/web/jose/current/msg05613....