Find JWT verification that trusts the token

Check every JWT consumer for real signature verification with a pinned algorithm.

grep -rEn "jwt.(decode|verify)|jsonwebtoken|jose|parseClaimsJws|decode_token" --include=*.{py,js,ts,java,go,rb} .

The bugs are decode without verify or no algorithm pin.

jwt.decode(token, verify=False)                 # trusts attacker claims
jwt.decode(token, key, algorithms=["HS256","RS256"])  # allows confusion

Pro note: allowing both HS and RS families enables the public-key-as-HMAC-secret confusion attack, so the algorithm list must contain exactly the one expected. Also grep for the signing secret in source or config; a committed HS256 secret means anyone can mint admin tokens.