algorithm_confusion_with_key_forgery 1 Lab 08: JWT authentication bypass via algorithm confusion with no exposed key Feb 19, 2026