JWT authentication bypass via jku header injection 1 JWT authentication bypass via jku header injection 08/12/2024