Lab 235 — CloudPulse — Cross-Tenant JWT Replay via Missing Tenant Binding

hackadvisor

Task: Multi-tenant SaaS platform where JWT lacks tenant binding — tenant is determined by a separate cookie while the same signing secret is shared. Solution: Registered the target admin's email on a different tenant, obtained a validly-signed JWT, then replayed it cross-tenant by swapping the tenant cookie to gain admin access and retrieve the flag.