HackTheBox - Principal
Source: YouTube · IppSec · published Mar 14, 2026 · 31:51
Ippsec demonstrates the Hack The Box "Principle" machine, focusing on a critical 10.0 CVE in a Java JWT library that allows unsigned tokens to bypass validation 0:03-0:11.
Key Takeaways:
• The core vulnerability is a recently disclosed bug in a Java JWT library that permits an unsigned JWT to successfully pass validation checks 0:09-0:13.
• Unlike typical and often unrealistic "algorithm: none" exploits, this specific bug is considered highly realistic and practical for real-world scenarios 0:13-0:19.
• The flaw likely remained undetected for an extended period because it is hidden within JSON Web Encrypted (JWE) tokens, requiring deliberate effort to exploit 0:28-0:34.
The video promises further exploration into additional factors that make this CVE particularly interesting 0:36-0:37.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is Ippsec, and today we'll be doing Principle from Hack The Box, which the main focus is a 10.0 CVE that came out last week within the Java library pack for JWT. Essentially, there's a bug that allows for an unsigned JWT to pass validation. I found this pretty interesting as normally when I see the JWT algorithm set to none, I find it unrealistic as you just didn't see this happening in the real world, at least I didn't. However, there's a weird bug within this library which actually makes it completely realistic and pretty cool. It probably went undetected for so long because it's buried in the JSON web encrypted token, so you have to go out of your way to set algorithm to none. Anyways, there's more that makes it interesting, but we'll talk about that in jus…