A JSON Web Token seen in traffic used alg=none (unsigned, trivially forgeable) or carried no expiry, weakening session security.
How it's exploited
A JSON Web Token seen in traffic used alg=none (unsigned) or carried no expiry. An unsigned token can be rewritten to impersonate any user; a token without exp stays valid forever once stolen.
Why it matters
Authentication bypass or indefinite session hijacking, depending on which weakness is present.
How to fix it
Reject alg=none server-side and sign tokens with a strong algorithm (for example, RS256 or ES256).
Always set a short exp and validate signature and expiry on every request.