A JWT, two CVEs, and a series of systems left open behind the administrator's back

Overview In modern identity management systems, JWT is considered a "certificate of trust" - once the signature is valid, the system usually assumes that the identity inside the token is also trustwor