As I was doing some training the other day I came across some rather interesting bugs in a commonly used technology: JSON Web Tokens (JWT). Although JWT itself is fundamentally secure, some implementations are not. This post focuses on a specific type of bug related to certain implementations of the technology.