JWT with aud claim causes InvalidAudienceError, skipping valid weak-secret detection

[liquidsec]

Summary

When a JWT contains an aud (audience) claim, Generic_JWT.check_secret() raises jwt.exceptions.InvalidAudienceError during verification, even when the HMAC secret is correct and in the wordlist. This causes badsecrets to silently skip a legitimately weak JWT.

Root Cause

In generic_jwt.py, the jwtVerify method calls jwt.decode() with options={"verify_exp": False} but does not disable audience validation. PyJWT requires an explicit audience parameter when the token contains an aud claim, and raises InvalidAudienceError if one is not provided.

Reproduction

import jwt as pyjwt
from badsecrets.base import carve_all_modules

token = pyjwt.encode(
    {"sub": "test", "aud": "my-app", "role": "admin"},
    "keyboard cat",
    algorithm="HS256",
)

# This will raise InvalidAudienceError internally and return no results
results = carve_all_modules(requests_response=None, body=f'var t = "{token}";')
print(results)  # [] -- should have found "keyboard cat"

Suggested Fix

Add "verify_aud": False to the decode options in jwtVerify, matching the existing verify_exp exemption:

options={"verify_exp": False, "verify_aud": False}

Other claims that could cause similar silent failures: iss (issuer), nbf (not before). It may be worth disabling all validation except signature verification, since the goal is secret detection, not token validation.

[liquidsec]

fixed in 1.2