Breaking JWT to Forge an Admin Token

This lab is based on critical vulnerabilities found and reported by the auth0 security research team. CareBridge rebuilt its patient portal login after the last breach, and the engineers swear the new JSON Web Token (JWT) setup is airtight. You're back to prove otherwise. Sign in as an ordinary patient, inspect the token, and exploit a flaw to promote yourself into the clinical administration console to grab the flag.