Great challenge that deserved to write a walkthrough since I surely learnt a lot from it.
Basically this challenge has these vulnerabilities to exploit
Valid JWT forgery
python pickle RCE
finding information
First we need to gather information and find out the exploit point.Of course I focus on the jwt cookie after I logged in.