Easy
JWT Attacks
TicketFlow alg-none forgery
An internal help-desk system. The token verifier accepts whatever algorithm the token's header claims, including none.
PentestingHere Academy
Official Academy lab
- Attempts
- 1
- Solves
- 1
- Published
- 25 Aug 2026
Scenario
TicketFlow issues a JWT on login. The verifier accepts whatever algorithm the token's header claims, including none.
Goal
Forge a session token that makes you an admin (a normal login gives you role=agent). The admin queue prints the flag only once your token's role is admin.