Authentication bypass via unsupported algorithm fallback

Improper JWT validation in Xmidt cjwt 1.0.1 and earlier allows remote attackers to cause acceptance of untrusted JWT claims. The __cjwt_alg_str_to_enum helper converts algorithm lookup failures into alg_none, so cjwt_decode treats an unrecognized alg header as unsigned-token mode instead of rejecting it. Exploitation requires a consuming application to trust the successful decode result; accepted attacker-controlled claims can alter authorization decisions, while direct data access or code execution is not established.