I Made OpenID Connect Stop Checking Signatures (And Got Paid €0 For It) (opens in new tab)

A critical account-takeover bug on a European bike-share platform, a four-line forgery script, and the cruelest word in all of bug bounty…