Tag: jwt

All the articles with the tag "jwt".

• JWT algorithm confusion: turning a public key into a signing secret

  kOaDT

  9 Aug, 2026

  OopsSec Store publishes its partner signing key on purpose, so partners can verify webhooks. Its token verifier also accepts HS256. Those two facts together let anyone mint a token for any supplier and read their purchase orders.

• JWT Weak Secret: Cracking the Key to Forge Admin Access in OopsSec Store

  kOaDT

  23 Jan, 2026

  Exploiting a JWT implementation that uses a weak signing secret to crack the key, forge admin credentials, and access restricted endpoints.