Lab 411 — CloudGate — JWT Algorithm Confusion via fast-jwt

hackadvisor

Task: CloudGate Express API gateway uses RS256 JWT auth with a JWKS endpoint exposing the RSA public key in a `pem` field; a developer account must reach an admin-only system report. Solution: fast-jwt RS256->HS256 algorithm confusion, forging an HS256 admin token HMAC-signed with the exact JWKS pem bytes (including leading/trailing newlines).