review-auth

The combined evidence shows multiple critical authorization weaknesses alongside a clearly implementable path to remediation. Highest priority: enforce ownership checks on all read/update endpoints that operate on per-user data (especially GET /orders/:orderId and PUT /users/:id), and restrict or validate role changes to prevent privilege escalation. Mitigate JWT algorithm confusion by pinning allowed algorithms and aligning token issuance/verification. Maintain secure session cookies and ensure HTTPS deployment. Overall security risk remains significant until these mitigations are applied, with IDOR and privilege-escalation being the primary concerns.