Fancy Food Notifications — GPN CTF 2026
Chaining a weak RNG seed (258 possible HMAC keys), an SSRF token leak, a urlparse vs urllib3 parser differential, and a URL-userinfo Basic-auth override to forge a VIP JWT and reach /vip-meal as localhost.
Basic-Auth
No writeups match your filter.