JWT kid Parameter Attacks: SQL Injection and Path Traversal via Key ID

Every JWT carries a header parameter whose only job is to tell the server which key to use. The RFC...