It is an extra vuln. if the JWT only has the role=admin K/V, and no expiration value. A jwt that is only valid for a certain time is no less secure than a sess

It is an extra vuln. if the JWT only has the role=admin K/V, and no expiration value. A jwt that is only valid for a certain time is no less secure than a session id, as long as you verify the signature correctly.