# Meridian Admin — JWT alg:none (CTF challenge)

> Meridian's admin console issues a signed JWT at login. But its verifier trusts whatever algorithm the token claims — including 'none'.

Canonical: https://codelivly.com/ctf/challenges/meridian-jwt-none

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Medium |
| Points | 450 |
| Estimated time | 25 min |
| Type | Live instance |
| Solves | 21 |
| Author | Codelivly |

Meridian's admin console issues a signed JWT at login. But its verifier trusts whatever algorithm the token claims — including 'none'. Log in as the regular user (jdoe / password1), then forge a token that makes you an admin and read /admin, which returns the flag.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)