Bug Bounty Challenge - Advanced 01

You’re testing a web app and find an endpoint that accepts a JWT in the Authorization header.
The server verifies tokens but does not enforce the alg value from a trusted list, and you see a token signed with alg: "HS256".
You try changing the token header to alg: "none" and the server accepts it.

What is the most serious impact you can achieve from this vulnerability?

1. Steal users’ plain-text passwords from the database
2. Forge tokens to impersonate an admin account and gain full app access
3. Trigger server-side remote code execution (RCE) immediately
4. Cause a DoS by flooding token verification calls

Comment Your Answer Below