User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation through the JWTClaimsRegistry in src/joserfc/rfc7519/claims.py. An attacker can make a JWT with an array-typed iss claim pass an exact-issuer check by supplying a list that contains the expected issuer string...