4 min read
GaslightCTF 2026 — biscuit Writeup
A voting app mints Biscuit capability tokens from the username you type. The username is pasted straight into Datalog source, so a crafted signup injects a role("admin") fact into a token the server signs for you and unlocks the staff room flag.
#CTF#Cybersecurity#Web