JWT Attack Methodology

JWT tokens look like: header.payload.signature (base64url-encoded, dot-separated).

A JWT vulnerability means the server accepts a token it should reject — either because the signature check is weak, skipped, or bypassable.