$ cat writeup.md…
$ cat writeup.md…
broncoctf2026
Task: Flask login API that performs all authentication on the client side. Solution: read /api/config to leak the credentials, then bypass auth entirely by POSTing {\"authenticated\":true} to /login (server trusts the client-asserted flag) and reuse the session cookie on /flag.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar