Why Cursor Decodes JWTs Instead of Verifying Them (CWE-347)

AI editors fix a Next.js middleware build error by swapping jwt.verify() for jwt.decode(), so anyone can forge an admin token.