Visit the challenge IP address in your browser.

It will load OpenSecret Helpdesk

To view its source code press CTRL+U

Upon analyzing the source code you will notice a const named SECRET_KEY:

...<SNIP>...
        <script>
            // JWT Secret Key
            const SECRET_KEY = "HTB{████████████████████████████}";
...<SNIP>...
                });
        </script>

This reveals a critical security flaw: the secret key used for signing JWT tokens is exposed on the client side.

Since JWT authentication depends on keeping the secret key confidential, an attacker could use this key to forge valid tokens and potentially escalate privileges.

In this case, the flag is directly exposed within the source code, making it trivial to retrieve.