Is everyone in this thread only going to read the first two paragraphs of the article and skip the rest of it? > I found I could request JWTs for any Email ID

Is everyone in this thread only going to read the first two paragraphs of the article and skip the rest of it? > I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple’s public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim’s account.