Tag: algorithm-confusion

All the articles with the tag "algorithm-confusion".

• JWT algorithm confusion: turning a public key into a signing secret

  kOaDT

  9 Aug, 2026

  OopsSec Store publishes its partner signing key on purpose, so partners can verify webhooks. Its token verifier also accepts HS256. Those two facts together let anyone mint a token for any supplier and read their purchase orders.