Illustrative scenarioDate not recordedIllustrative scenario

JWT Secret Key Confusion & Privilege Escalation

Backend accepted HMAC-SHA256 tokens signed with public RSA key, allowing attacker to forge administrator tokens.

Illustrative scenario, not a real incident

A composite failure pattern written by CollectSEA for learning and demos. It is NOT a documented real-world incident and has no primary source.

What happened

    Contributing factors stated by the source

    • Backend accepted HMAC-SHA256 tokens signed with public RSA key, allowing attacker to forge...

    The failure pattern

    Duplicate action after an ambiguous resultA request times out, the caller assumes it failed and retries, and the money moves (or the order ships) twice.How to prevent it Automation acts on stale state or authorizationA background job or automation acts on a plan, permission or record that changed after it was read.How to prevent it
    Watch the pattern: Duplicate action after an ambiguous result

    Related standards

    CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

    Building something similar?

    Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

    Analyze your design

    Incidents with the same pattern