# TryHackMe TryHeartMe—Writeup Welcome back to another part of the Valentine's special CTF series of TryHackMe, TryHeartMe. No drama, let's start.
Let's visit the website as always since this is a web category challenge:
Oh, a Valentine's shop, let's register and try to buy something for nothing.
After completing the registration process, we were redirected back to the main dashboard, now authenticated with a valid account.
As you can see, our credits is 0, so we can't buy anything. As I inspect the page, I noticed this **JWT** token that looks interesting:
Next thing I did is to decode it using my own decoder for **JWT** (Will release the source code of this in the future hehe).
Upon inspecting the authentication mechanism, it was observed that the application stored sensitive fields, specifically the user **role** and **credit balance,** directly inside the JSON Web Token (JWT). This design choice indicates that the application relies on the token’s payload to determine both authorization level and available credits. In other words, access control and balance-related decisions are derived entirely from data supplied by the client through the JWT. Since JWTs are issued to the client and included with every request, this places a significant amount of trust on client-controlled data rather than enforcing these checks server-side. JWTs are readable by default. If the application does not properly validate the token’s signature or allows weak configurations, an attacker may alter the payload to escalate their role or inflate their credit balance. What we can do is to change the role to **admin** and credits to **9999999999**:
With the forged token prepared, we injected it into the browser’s cookie storage and refreshed the page to apply the changes.
Observe the updated credit balance, and an additional item now visible. This item appears to be restricted to administrative accounts. Since the role was forged to `admin`, the account gained access to content that would otherwise be unavailable.
So it's the flag I guess, since we have unlimited credits, we can buy it!
After purchasing the Valenflag, we've got the flag! This challenge ends not with complexity, but with misplaced trust. The application handed its most critical decisions, identity, authority, and value to a token never meant to carry that weight. By relying on JWTs as a source of truth rather than a proof of identity, the system quietly surrendered control to the client. No brute force. No exploit chain. Just a broken assumption. JWTs are powerful when treated correctly. When they aren’t, they don’t fail loudly, they fail silently, leaking privilege and trust one field at a time. And in the end, the flag wasn’t earned by breaking encryption, but by exposing a system that trusted too much… and verified too little.