Replay Attack

github.com/ory/hydra is vulnerable to replay attack. During the client authentication using the method private_key_jwt, Hydra does not check the uniqueness of jti token (a unique identifier for the token) to prevent the reuse of the token more than one time unless there are conditions for reuse between the parties, allowing an attacker to get two access tokens.