A valid JWT isn't always authorized. Discover how missing audience checks expose APIs to token replay and how to prevent it.