Jwt None Alg
FileVault issues a signed JWT in a session cookie after login. The /admin endpoint, however, trusts the algorithm named in the token header — including none. Forge an unsigned token carrying role: admin, send it as the session cookie, and read the flag from the admin console.