#jwt — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #jwt, aggregated by home.social.
-
A JWT validator that checks every claim but never the signature tells the attacker which claim to fix next. Faav's Microsoft Titan writeup: tenant error, audience, app allowlist, then "User not found". An alg:none token got that far. An AI hackbot spent ten days on email-style UPNs. A human typed the one that worked: "admin". Reachable: an estimated 17.3 trillion rows.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
-
A JWT validator that checks every claim but never the signature tells the attacker which claim to fix next. Faav's Microsoft Titan writeup: tenant error, audience, app allowlist, then "User not found". An alg:none token got that far. An AI hackbot spent ten days on email-style UPNs. A human typed the one that worked: "admin". Reachable: an estimated 17.3 trillion rows.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
-
A JWT validator that checks every claim but never the signature tells the attacker which claim to fix next. Faav's Microsoft Titan writeup: tenant error, audience, app allowlist, then "User not found". An alg:none token got that far. An AI hackbot spent ten days on email-style UPNs. A human typed the one that worked: "admin". Reachable: an estimated 17.3 trillion rows.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records