CVE-2026-33746: Lcobucci Jwt Validate Without Signedwithcve-2026-33746-lcobucci-jwt-validate-without-signedwith
JWT validation via lcobucci/jwt does not include a `SignedWith` constraint. Only time-based or other non-cryptographic constraints are passed to `validator()->validate()` / `validator()->assert()`, so the token's cryptographic signature is never verified. An attacker can forge or tamper with the JWT payload (e.g. impersonate any user via a `user_uuid` claim)
