Trust the Token
0 teams solved
300 pts
Our API trusts whatever this token says. An attacker sent it and became admin. Decode it: the attacker left a note.
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhbGljZSIsInJvbGUiOiJhZG1pbiIsIm5vdGUiOiJjdGZib3h7YWxnX25vbmVfaXNfbm90X2Ffc2lnbmF0dXJlfSJ9.Bonus question for your team (no points): why was the server wrong to accept it?
Sign in with GitHub to submit a flag.