Which JWT implementation flaw could allow an attacker to forge a valid token with arbitrary claims?

• A. The token uses a strong signing key for JWT
• B. A developer uses a weak signing key for JWT
• C. The token sets a very short expiration
• D. The token uses an incorrect audience claim

Answer: (B)

Signing key strength determines whether a JWT can be forged. JWTs are signed so the recipient can verify both the integrity and the origin of the token. If the signing key is weak, an attacker can guess or brute-force the key and then create tokens with any payload they choose. Since they control the signature for that token, the server will accept it as valid, including arbitrary claims like user identity, roles, or other privileges.

Using a strong signing key keeps the key secret and makes forging impractical, because producing a valid signature without the key is not feasible. A very short expiration helps limit how long a forged token could be used, but it does not prevent forgery itself. An incorrect audience claim may cause validation to fail if the server checks it properly, and it does not enable forging of arbitrary claims.