connect.8x8.com/api/v1: JWT Algorithm Confusion Vulnerability

Summary

@kyotozzx reported a JWT algorithm confusion vulnerability in the v1 API of connect.8x8.com. The JWT verifier did not enforce algorithm pinning and would accept HS256 tokens signed with the RSA public key used as an HMAC secret.

Exploitation required knowledge of a target user's non-enumerable UUID and an active server-side session for that user. Under these conditions, forged tokens were accepted by v1 read endpoints for account information retrieval. All state-changing endpoints independently rejected forged tokens, limiting impact to read-only access without privilege persistence or account takeover.

Remediation:

The v1 API verifier now enforces RS256 algorithm pinning, rejecting any tokens using alternative signature algorithms. The fix has been deployed to production and verified effective.

We thank @kyotozzx for the thorough analysis and detailed proof of concept.