webPromedium

LeadVault

hackadvisor

Task: Express.js CRM with OAuth 2.0 authentication and team-based data scoping. Solution: Abused unauthenticated client_credentials grant type (discovered via JS comments) to mint a service-account JWT that bypasses team filtering, revealing hidden system contact with flag in notes field.

$ ls tags/ techniques/
jwtnodejsauthentication_bypassinformation_disclosurenginxdecoy_flagoauth2client_credentialsapi_misconfigurationexpress_jsteam_scoping_bypassservice_account
javascript_source_analysisdecoy_flag_avoidanceoauth_client_credentials_abuseunauthenticated_grant_typeservice_token_mintingteam_access_control_bypass
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups