The Client
A cryptocurrency exchange commissioned a review of authentication, authorisation and connected application components.
The Challenge
The client had undergone a penetration test six months prior, conducted by a reputable firm. That assessment produced 18 findings — all rated low or medium severity. Missing security headers, verbose error messages, a few informational items. The conclusion: the platform was secure.
The client requested a deeper review of authentication and trust boundaries across connected components.
They were right.
Our Approach
We deployed our TOTAL assessment package — 21 days of comprehensive testing covering the trading platform, REST and WebSocket APIs, authentication and authorization layers, wallet infrastructure, admin panel, and mobile applications.
We mapped 186 API endpoints across three subdomains, reverse-engineered the mobile application to extract hardcoded configuration, and documented the complete authentication flow — OAuth 2.0 with JWT session tokens, WebSocket authentication via a secondary token, and a separate admin authentication path.
The previous pentest had tested the login form and a dozen trading endpoints. The WebSocket layer, the OAuth state machine, and the admin authentication path were not in their scope documentation.
Authentication is not a single gate. It's a system of interconnected decisions — token issuance, session binding, privilege escalation, cross-service trust. We tested each decision point independently and in combination.
We built reproducible proof-of-concept chains demonstrating account-level impact. Every critical finding included a curl command, server response, and negative control proving the vulnerability was real and not a testing artifact.
Full report delivered. Emergency remediation call within 4 hours of delivery. Critical findings patched in parallel with report review.
Key Findings
JWT Algorithm Confusion → Admin Privilege Escalation CVSS 9.8
The JWT validation library accepted both RS256 (asymmetric) and HS256 (symmetric) algorithms. The public key was exposed via a standard JWKS endpoint. By signing a token with the RSA public key using HS256, an attacker could forge tokens with arbitrary claims — including the admin role flag.
This is a known vulnerability class (CVE-2015-9235). The previous pentest checked for "alg": "none" and moved on. They did not test algorithm confusion because the JWKS endpoint returned RS256, and the login response used RS256. The server, however, accepted both.
OAuth Session Fixation → Account Takeover CVSS 9.6
The OAuth callback endpoint did not validate the state parameter against the session that initiated the flow. An attacker could initiate an OAuth flow, capture the authorization URL, and deliver it to a victim. When the victim completed authentication, their OAuth token was bound to the attacker's session. Combined with a missing Referer check on the callback, this worked cross-origin.
Net result: any user who clicked a crafted link and authenticated with their social provider handed their account to the attacker. No phishing page required. No credentials stolen. The legitimate login flow was the attack vector.
The Chain: JWT + OAuth = Full Account Takeover
- OAuth session fixation captures a victim's authenticated session
- JWT algorithm confusion escalates that session to admin
- Admin panel exposes wallet management — withdrawal address modification, 2FA reset, KYC override
From a single click to full account control, including fund withdrawal. We demonstrated the complete chain on a test account, from initial link delivery through to a pending withdrawal request.
Results at a Glance
| Metric | Previous Pentest | VCG Assessment |
|---|---|---|
| Critical findings | 0 | 8 |
| High findings | 0 | 15 |
| Medium findings | 6 | 14 |
| Low / Info | 12 | 8 |
| Total | 18 | 45 |
| Authentication flaws | 0 | 9 |
| Attack chains identified | 0 | 4 |
Remediation Timeline
The client's response was immediate:
-
Hour 0–4Emergency call. JWT validation hardcoded to RS256 only. OAuth state parameter enforcement deployed.
-
Hour 4–24All 8 critical findings patched in staging.
-
Day 2–3Production deployment with VCG verification re-test.
-
Week 2All high-severity findings remediated.
-
Day 72Complete remediation confirmed across all 45 findings.
Zero user accounts were compromised. The vulnerability existed for an estimated 14 months prior to discovery.
Client Feedback
“The first pentest gave us confidence. VCG gave us clarity. The difference between finding missing headers and finding a full account takeover chain — that's the difference between checking a box and actually being secure.”
— Chief Security Officer
The Takeaway
A penetration test is only as valuable as the depth of its analysis. Testing the login form is not testing authentication. Testing an API endpoint is not testing business logic. Testing a JWT is not testing the trust model behind it.
The findings we uncovered were not exotic zero-days requiring novel research. They were known vulnerability classes — applied to a specific codebase, in a specific combination, creating a specific impact. Finding them required understanding how the system worked as a whole, not scanning it as a list of endpoints.
Your last pentest found nothing critical. That's either very good news — or very bad news. We help you find out which.
This case study has been anonymized. All identifying details have been changed. Findings described are representative of the engagement scope and methodology.