JWT / token authentication attacks

When it applies

The app authenticates with a JSON Web Token and trusts claims inside it (user id, role, isAdmin). The win is forging a valid-looking token the server accepts.

Why it works

JWTs are only as safe as their signature verification. Implementations routinely skip it, confuse algorithms, or trust attacker-controlled key hints (kid, jku, x5u). If you can make the server accept a signature you produced, you own every claim.