# "alt": "none" validation bug on jwt.io **URL:** \ **Category:** Get Help\ **Tags:** vulnerability\ **Created:** [June 22, 2017, 8:31pm UTC](https://community.auth0.com/t/alt-none-validation-bug-on-jwt-io/7210 "2017-06-22T20:31:18Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ra\_hardy](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@ra\_hardy](https://community.auth0.com/u/ra_hardy)\ **Post date:** [June 22, 2017, 8:31pm UTC](https://community.auth0.com/t/alt-none-validation-bug-on-jwt-io/7210/1 "2017-06-22T20:31:18Z")
On [https://jwt.io/](https://jwt.io/), if I change “alg”: “HS256” to “alg”: “none”, then the signature still passes validation. I can then change the body contents at will. This seems to be the very bug that the blog post in the warning on the same page warns about ([https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/](https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/)) To be clear: if the header is eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0 then the token validates even though a signature is present ---
**Author:** ![prashantT](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/prashantt/32/6002_2.png) [@prashantT](https://community.auth0.com/u/prashantT)\ **Post date:** [June 23, 2017, 10:02am UTC](https://community.auth0.com/t/alt-none-validation-bug-on-jwt-io/7210/2 "2017-06-23T10:02:19Z")
Thanks for letting us know, I have logged this with the engineering team to fix. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 2, 2018, 5:54am UTC](https://community.auth0.com/t/alt-none-validation-bug-on-jwt-io/7210/3 "2018-03-02T05:54:52Z")