Hard
JWT Attacks
VaultAPI tokens (JWT)
A JSON API issues JWTs and accepts the "none" algorithm, so you can forge an admin token.
PentestingHere Academy
Official Academy lab
- Attempts
- 3
- Solves
- 2
- Published
- 6 Sep 2026
Scenario
VaultAPI is a small JSON API. POST /api/login gives you a JWT for a normal user. The flag
lives behind GET /api/flag, which is admin-only.
Goal
Call GET /api/flag successfully and submit the flag it returns. A normal user's token is
rejected there with "admin only".