#jwt

API trusted any login token that decoded cleanly

The API read the user and organization straight out of bearer tokens without checking the signature, so anyone could have written their own. I swapped in real verification against the provider's keys, a pinned algorithm and a parsed issuer check, and review caught two more holes I'd left.