#Authentication Bypass
2 postsBugForge - Daily - Cheesy Does It (Jul 15, 2026)
Cheesy Does It checks username uniqueness on the raw string but NFKC-normalizes the username when authorizing admin actions. Registering a fullwidth homoglyph of admin (ａdmin) creates a distinct account that the app treats as the administrator, leaking the flag from the admin dashboard.
Unicode Normalization Homoglyph Broken Access Control Privilege Escalation Authentication Bypass Improper Input Validation
Posted on 2026-07-15 20:00 6 min read
BugForge - Daily - Shady Oaks Finance (Jan 9, 2026)
This challenge demonstrates a JWT (JSON Web Token) authentication bypass vulnerability caused by improper algorithm validation. The application accepts…
JWT Authentication Bypass None Algorithm Broken Authentication
Posted on 2026-01-09 20:00 4 min read