Post

PentesterLab@pentesterlab.com

🔥 CVE-2026-23993: HarbourJwt JWT auth bypass via unknown alg. Not just alg=none: unsupported alg => empty signature, so forged token header.payload. passes. Write-up + fix: pentesterlab.com/blog/cve-202...

pentesterlab.comCVE-2026-23993: JWT authentication bypass in HarbourJwt via “unknown alg”I didn't know Harbour even existed as a language when I found this bug. The fun part is that I also ...