Security Event Token (SET)
A Security Event Token (SET) is a JWT that states that a security event occurred to a subject, defined in RFC 8417 (Proposed Standard, July 2018) and used as the envelope for every CAEP and RISC event in the OpenID Shared Signals Framework.
A SET is not an access token and grants nothing: it carries an events claim describing what happened, such as a session revoked or a credential changed, and the receiver decides what to do. Delivery is specified separately, by push over HTTP in RFC 8935 or by polling in RFC 8936, and subjects are described using the formats in RFC 9493. Because a SET is a signed JWT, receivers must verify issuer, audience, and signature exactly as they would for any other token; a forged "account enabled" event is an attack, not a notification.
See also: Shared Signals Framework, CAEP, RISC, JWT, SCIM
Related on Start with Identity
- GlossaryToken Introspection
OAuth 2.0 Token Introspection ([RFC 7662](https://www.rfc-editor.org/rfc/rfc7662), Proposed Standard, October 2015) defines an endpoint where a resource server
- GlossaryOpenID Connect (OIDC)
OpenID Connect is an authentication layer built on top of OAuth 2.0. Where OAuth tells you what a token is authorized for, OIDC tells you who the user is via a
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- CVESharePoint JWT validation chain, forge a token and become any user
Four weaknesses across two SharePoint JWT token handlers chain into an unauthenticated authentication bypass. Rapid7 published a proof of concept in August 2026
- CVEAuth0 node-jws HS256 verification bypass via secret lookup
node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature
- CVEICS JWT auth bypass via hard-coded constants
An industrial-control product accepted JWTs built from hard-coded constants (CWE-547). Critical authentication bypass. CISA ICSA-25-175-07.