Silent HMAC Key Contamination: Uncovering a Logic Flaw in Burp's JWT Editor Extension

How a failing Web Security Academy lab led to a root-cause analysis of a hidden bug JWT Editor was shortlisted for "Best Auth & Access Control" in PortSwigger's 2026 Burp Suite Extension Awards . This is the story of finding a silent bug inside it. Usually, when something goes wrong, your first instinct is to look at yourself. What did I do wrong? Which step did I miss? It takes a lot to get to the point where you seriously consider that the mistake isn't yours at all: it's the tool's. It's a bit like a developer insisting their code is broken because of VS Code itself. Especially when everyone around you is saying the opposite, and your own eyes keep telling you the same thing they're saying. But sometimes you have to hold onto an old piece of advice: "Once you eliminate the impossible, whatever remains, no matter how improbable, must be the truth." — Arthur Conan Doyle (Sherlock Holmes) This is the story of how a training lab that "shouldn't have been failing" turned into a fifteen-hour investigation, a silent bug, and a GitHub issue against the #1 most popular extension in the Burp Suite BApp Store as of today. Some Background: What Is JWT Algorithm Confusion? Before the story makes sense, you need the theory behind it. JWT algorithm confusion is a class of vulnerability that stems from how some backend libraries implement token verification. Some implementations write code like this: publicKey = < public - key - of - server > ; token = request . getCookie ( " session " ); verify ( token , publicKey ); The problem is that if the server receives a token signed with a symmetric algorithm like HS256 instead of the expected asymmetric RS256, some libraries' generic verify() method will happily treat the public key (which is, by definition, public and known to anyone) as if it were an HMAC secret. If an attacker can get their hands on that public key, they can sign their own token with it using HS256, and the server will trust it. If you want the full technical breakd