Serialized Offender

"Your session is just a blob of misplaced trust. Reshape the bytes, sign nothing." That's the hint, and it's literal — the session is base64url'd JSON with no signature:

{"user":"analyst","role":"analyst"}

There's nothing to forge; you just flip role and re-encode. The only actual work is guessing the privileged string. admin and superadmin get rejected — the magic value is administrator (the formal spelling of the admin you start with).

{"user":"analyst","role":"administrator"}  →  base64url  →  POST /action-d34380

Server decodes it, believes the role verbatim, and returns serialized_role_trusted with the proof. A sibling instance used base64url (-_ instead of +/) — worth noting, though it didn't matter here since the JSON produced no + or /.