pentester.land· Jun 20, 2022· by Eaton Z. (@XeEaton)

Hacking into the worldwide Jacuzzi SmartTub network

Target Program: Jacuzzi Group, SmartTub

🎯 Vulnerability: OAuth 2.0 / JWT Authentication Bypass

💡 Defense Fix: Strictly verify JWT signatures on the backend, enforce state parameter validation, and reject 'alg: none'.

#SPA#Android#JWT#Privilege escalation#Mass assignment