broken-authentication 2 JWT Secret Cracking & Privilege Escalation via Forged Tokens | Tally May 14, 2026 OTP Bypass & Brute Force – Admin Account Takeover via Password Reset | Cheesy Does it May 5, 2026