Gatery

CACTF2026

Task: Bun+Elysia 1.4.18 web app gates a flag endpoint behind a signed session cookie whose admin password is unguessable random. Solution: Elysia 1.4.18's parseCookie array-of-secrets branch initializes decoded=true and never resets it on signature failure, so a forged unsigned cookie session=inside is accepted, bypassing login and gate to read the flag in one request.