Unverified60% confidenceFactExact time
The algorithm confusion attack between RS256 and HS256 can allow an attacker to use the public key as an HMAC secret to forge tokens that the server will accept as valid.
2
Sources
60%
Confidence
Long-term
Relevance
9/22/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedHS256 uses a symmetric key and is suitable for monolithic services, while RS256 uses an asymmetric key pair and is suitable for microservice scenarios.80% similarUnverifiedJWT存在算法混淆攻击风险，例如将RS256篡改为HS25673% similarUnverifiedThe RSA scheme uses private key signing and public key verification, offering relatively high security but generating longer activation codes.72% similarUnverifiedThe malicious code adds the attacker's public key to the user's SSH authorized keys list (~/.ssh/authorized_keys), with the comment field disguised as SBC Telemetry.72% similarUnverified工具投毒攻击可将读取 SSH 私钥并外传的隐藏指令暗藏在工具描述中，同时返回正确结果71% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/941999API
curl https://kongchang.com/api/v1/knowledge/claims/941999MCP
get_claim(id=941999)