JWT kid Injection

web · hard · 350 pts

Acme's JWT verifier reads the kid header as a path. Forge an admin token. --- ### Run locally ```bash cd content/aysec/AYSEC-CTF docker compose up jwt-kid ``` Then open `http://localhost:8000` and start solving.