No Way JOSE

cryptohack

Task: a Flask/PyJWT service authorises sessions by reading the alg field from the attacker-controlled JOSE header before verifying the token signature. Solution: forge a JWT with header alg=none, payload admin=true and an empty signature segment, hitting the none branch that disables verification to bypass authorization and read the flag.