Write-up3 min
The JWT that trusted its own header
Personal lab
A lab write-up on an authentication bypass through JWT algorithm confusion — the classic 'alg: none' and its slightly less obvious RS256-to-HS256 cousin.
- Write-ups
- Web Security
- Authentication
Article2 min
The JWT mistakes that still work in 2026
Algorithm confusion, unverified signatures and secrets that were never secret. A tour of the JWT failures I keep finding in labs, and what each one actually requires to exploit.
- Web Security
- JWT
- Authentication