Meridian Wealth statement token forgery
A robo-advisor dashboard. A "signed" statement token isn't actually signed with any secret.
PentestingHere Academy
Official Academy lab
- Attempts
- 2
- Solves
- 2
- Published
- 25 Aug 2026
Scenario
Meridian Wealth's dashboard links to account statements via /statement.php?token=. The token looks tamper-proof: it's base64 of the account id plus a hash.
Goal
Read the statement of another client, ewhitfield (not your own account), by presenting a token the dashboard accepts for it. The flag is that statement's archive verification string.