# Meridian Admin — JWT alg:none Bypass (lab)

> Meridian's admin panel trusts a JSON Web Token. Its verifier accepts tokens that say they are signed with "none" — so you can forge an admin token with no signature at all.

Canonical: https://codelivly.com/labs/jwt-none

| | |
|---|---|
| Type | Web |
| Difficulty | Intermediate |
| Points | 300 |
| Session length | 30 min |
| Completions | 9 |

Meridian's admin panel trusts a JSON Web Token. Its verifier accepts tokens that say they are signed with "none" — so you can forge an admin token with no signature at all.

## Objective

Learn the JWT alg:none authentication bypass: a token whose header claims the algorithm is "none" tells a naive verifier to skip signature checking, letting anyone forge any claims.

## Tasks

1. Get your guest token
2. Decode it
3. Rewrite the claims
4. Forge an alg:none token
5. Hit the admin panel

## Related

- [All labs](https://codelivly.com/practice?type=lab)