On: Auth0 JWT Auth Bypass: Case-Sensitive Blacklisting Is Harmful

[XMPPwocky]

And to be clear, these are not "oh, an adaptive chosen plaintext attack and 2^56 compute may be able to forge signatures" bugs.

These are real, exploitable, and many of the fixes probably won't be backported.