JWT access token decoding fails because Base64URL is treated as standard Base64

[n-etupirka]

Description

When AzureHound processes Entra ID access tokens (JWT), decoding may fail with a Base64-related error.
This issue appears to be caused by treating JWT segments as standard Base64 instead of Base64URL.

Reference: https://datatracker.ietf.org/doc/html/rfc7515#section-7.1

PS C:\tools\AzureHound_v2.8.2_windows_amd64> .\azurehound.exe list az-rm -j $arm --tenant $tenant
AzureHound v2.8.2
Created by the BloodHound Enterprise team - https://bloodhoundenterprise.io

No configuration file located at C:\Users\XXXXX\.config\azurehound\config.json
2025-12-26T11:18:16+09:00 ERR encountered unrecoverable error error="failed to create new Azure client: illegal base64 data at input byte XXX"

Steps to reproduce

Unfortunately, I was unable to intentionally reproduce a JWT access token that fails when decoded with standard Base64 but succeeds with Base64URL.

Expected behavior

The JWT access token should be decoded successfully without errors.

Fix

A Pull Request addressing this issue already exists. (#111)
I confirmed that applying the same patch to the latest source code successfully resolves the problem.

[Mike-Crowley]

+1 on this. Confirmed the same issue on v2.11.0 (Windows amd64) with a GCC tenant.

Root cause: client/rest/utils.go line 90 uses base64.RawStdEncoding.DecodeString() — should be base64.RawURLEncoding.DecodeString(). JWTs use base64url encoding per RFC 7519, which uses - and _ instead of + and /.

Workaround: Use app registration auth (-a/-s) instead of --jwt to bypass the broken ParseBody() function entirely.

Additional gotcha: If the AZUREHOUND_JWT environment variable is set (e.g. from a prior attempt), AzureHound picks it up even when -a/-s flags are provided, since config.JWT is checked first in NewClient() (client/client.go line 43). This causes the same base64 error despite using app credentials. Clear it with $env:AZUREHOUND_JWT = $null (PowerShell) or unset AZUREHOUND_JWT (bash).

References:

• Well-known class of bug in Go JWT libraries: another --- illegal base64 data at input byte dgrijalva/jwt-go#293
• Closing JWT parsing fails with 'illegal base64 data' due to RawStdEncoding vs RawURLEncoding #186 as duplicate of this issue.

[StranDutton]

Merged #111 - closing this 👍