Attacker Key Host — Token Forge

[ 01 ] harvest a payload

> existing jwt > decoded header (reference only — the forged token always uses this host's own kid/jku, not whatever's here)

[ 02 ] tamper & sign

> payload.json (edit freely — id, role, whatever the target app trusts) > forged token (set this as the "jwt" cookie on the target app) > header used to sign it