Tag: cryptographic

All the articles with the tag "cryptographic".

• JWT algorithm confusion: turning a public key into a signing secret

  kOaDT

  9 Aug, 2026

  OopsSec Store publishes its partner signing key on purpose, so partners can verify webhooks. Its token verifier also accepts HS256. Those two facts together let anyone mint a token for any supplier and read their purchase orders.

• Padding oracle attack: forging encrypted share tokens

  kOaDT

  13 Mar, 2026

  A padding oracle in OopsSec Store's share feature leaks whether decryption produced valid PKCS#7 padding. That's enough to forge a token for an internal report and grab the flag.