As part of our CVE monitoring, we came across GHSA-pcq9-mq6m-mvmp (CVE-2025-68402), an authentication bypass in FreshRSS, a self-hosted RSS aggregator. It ...
I didn't know Harbour even existed as a language when I found this bug. The fun part is that I also ...
JSON Web Tokens (JWTs) are widely used for authentication, authorization, and secure information exchange in modern web applications. They're often used ...
JWT.io is widely known among developers for its convenient JWT debugger and its curated list of libraries supporting JSON Web Tokens ...
Recently, I was in Brisbane to give a talk on JWT algorithm confusion vulnerabilities. During a conversation with my friend Luke ...
I've read the source code of many JWT libraries—some might say, too many. In doing so, I've seen patterns of both ...
When I wrote the first lab on algorithm confusion, I remember spending a bit of time trying to find a vulnerable ...
When doing security code review, you sometimes come across infuriating code—code that appears to be vulnerable but isn't, due to unexpected ...
JSON Web Tokens (JWT) are widely used for authentication in modern applications. As their use increases, so does the importance of ...