Silent HMAC Key Contamination: Uncovering a Logic Flaw in Burp's JWT Editor Extension

Listen in the Podli app 🎧

Follow your favourite podcasts, listen offline and in the car with CarPlay and Android Auto, and always pick up where you left off. Free to try.

This story was originally published on HackerNoon at: https://hackernoon.com/silent-hmac-key-contamination-uncovering-a-logic-flaw-in-burps-jwt-editor-extension.
JWT Editor was shortlisted for “Best Auth & Access Control” in PortSwigger’s 2026 Burp Suite Extension Awards. This is the story of finding a silent bug inside.
Check more stories related to cybersecurity at: https://hackernoon.com/c/cybersecurity. You can also check exclusive content about #bug-bounty, #burp-suite, #burp-extensions, #web-security, #infosec, #reverse-engineering, #penetration-testing, #hackernoon-top-story, and more.

This story was written by: @rivenx173. Learn more about this writer by checking @rivenx173's about page, and for more stories, please visit hackernoon.com.

JWT Editor was shortlisted for “Best Auth & Access Control” in PortSwigger’s 2026 Burp Suite Extension Awards. This is the story of finding a silent bug inside.