{"record":{"id":"b75dcd5deac56ecc","repo":"sqlmapproject/sqlmap","slug":"unsupported-algorithm-s-for-forging","errorCode":null,"errorMessage":"unsupported algorithm '%s' for forging","messagePattern":"unsupported algorithm '(.+?)' for forging","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"lib/utils/jwt.py","lineNumber":79,"sourceCode":"    \"\"\"Re-encode a (possibly tampered) header/payload, signing with 'key' for an HMAC 'alg' or leaving the\n    signature empty for 'alg':'none' - the primitive behind the alg:none and weak-secret exploitation paths.\n\n    >>> forgeJWT({\"alg\": \"none\"}, {\"user\": \"admin\"}).endswith('.')\n    True\n    >>> parseJWT(forgeJWT({\"alg\": \"HS256\"}, {\"user\": \"admin\"}, key=\"secret\"))[\"payload\"][\"user\"] == \"admin\"\n    True\n    \"\"\"\n\n    alg = (header.get(\"alg\") or \"none\")\n    signingInput = \"%s.%s\" % (encodeSegment(header), encodeSegment(payload))\n\n    if alg.lower() == \"none\":\n        signature = \"\"\n    elif alg.upper() in HMAC_ALGORITHMS and key is not None:\n        digest = hmac.new(getBytes(key), getBytes(signingInput), HMAC_ALGORITHMS[alg.upper()]).digest()\n        signature = encodeBase64(digest, binary=False, safe=True)\n    else:\n        raise ValueError(\"unsupported algorithm '%s' for forging\" % alg)\n\n    return \"%s.%s\" % (signingInput, signature)\n\ndef crackHMAC(token, secrets, limit=None):\n    \"\"\"Try to recover the HMAC signing secret of an HS* token from an iterable of candidate secrets; returns\n    the secret on success (a full forgery primitive), else None. Purely offline - no requests.\n\n    >>> token = forgeJWT({\"alg\": \"HS256\"}, {\"user\": \"admin\"}, key=\"s3cr3t\")\n    >>> crackHMAC(token, [\"admin\", \"s3cr3t\", \"letmein\"])\n    's3cr3t'\n    >>> crackHMAC(token, [\"admin\", \"letmein\"]) is None\n    True\n    \"\"\"\n\n    data = parseJWT(token)\n    if not data or (data[\"header\"].get(\"alg\") or \"\").upper() not in HMAC_ALGORITHMS:\n        return None\n","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/sqlmapproject/sqlmap/blob/0a35b20e3953d341be6c7ac75ccb0b3362540c8d/lib/utils/jwt.py#L61-L97","documentation":"Error \"unsupported algorithm '%s' for forging\" thrown in sqlmapproject/sqlmap.","triggerScenarios":"Thrown at lib/utils/jwt.py:79 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0a35b20e3953d341be6c7ac75ccb0b3362540c8d","analyzedAt":"2026-08-26T23:02:52.002Z","schemaVersion":2},"datasetVersion":"2026-08-27T03:17:27.898Z"}