JWT Algorithm Confusion: How the Wrong `alg` Forges Any User

JWT algorithm confusion lets attackers sign forged tokens with your public key. Real CVE examples, 10-min self-test, library defaults, and the exact fix.