Progress

0 / 12 findings triggered this session. Every item is a token, session, or auth-flow bug — decode first, then work the header alg, the kid, the published keys, exp, logout, the remember-me cookie, and the 2FA gate.

⬜ Weak HS256 secret cracked/forged -> role:admin accepted

⬜ alg:none token accepted (unsigned admin token)

⬜ RS256->HS256 algorithm confusion (public key used as HMAC secret)

⬜ kid header path traversal -> sign with an empty/known key file

⬜ Expired token still accepted (exp not validated)

⬜ Endpoint decodes token without verifying the signature

⬜ Predictable password-reset token forged -> admin takeover

⬜ Session token leaked in a URL / magic link

⬜ Old token still works after logout (no server-side invalidation)

⬜ "Remember me" cookie is just base64(username) -> forge another user

⬜ Role-gated internal page reached directly (forced browsing)

⬜ Second factor skipped via a client-trusted 2fa flag