Good catch. JWT is unicode out-of-the-box, which is really important to support non english user names and such. If Auth0 is doing any sort of normalization th

Good catch. JWT is unicode out-of-the-box, which is really important to support non english user names and such. If Auth0 is doing any sort of normalization they will definitely be vulnerable to all the normalization bugs from unicode. Would be a great follow up vulnerability.