Authlib: Default JWT bearer grant accepts assertions for the wrong audience

Description Summary Authlib's default RFC 7523 JWT bearer grant leaves getaudiences empty, so verifyclaims only checks that an aud claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any...