Silent HMAC Key Contamination: Uncovering a Logic Flaw in Burp's JWT Editor Extension

This story was originally published on HackerNoon at: https://hackernoon.com/silent-hmac-key-contamination-uncovering-a-logic-flaw-in-burps-jwt-editor-extension.
JWT Editor was shortlisted for “Best Auth & Access Control” in PortSwigger’s 2026 Burp Suite Extension Awards. This is the story of finding a silent bug inside.
Check more stories related to cybersecurity at: https://hackernoon.com/c/cybersecurity. You can also check exclusive content about #bug-bounty, #burp-suite, #burp-extensions, #web-security, #infosec, #reverse-engineering, #penetration-testing, #hackernoon-top-story, and more.

This story was written by: @rivenx173. Learn more about this writer by checking @rivenx173's about page, and for more stories, please visit hackernoon.com.

JWT Editor was shortlisted for “Best Auth & Access Control” in PortSwigger’s 2026 Burp Suite Extension Awards. This is the story of finding a silent bug inside.