Authenticated token replay via unchecked JTI reuse

Authentication bypass in Ory Hydra before 1.4.0+oryOS.17 allows remote authenticated users to obtain access tokens by replaying private_key_jwt assertions. Hydra accepts repeated assertions because the OAuth2 token endpoint does not enforce uniqueness of the JWT jti claim. The attacker must first obtain a valid signed client assertion and replay it within its short expiry window; successful replay can issue additional bearer tokens and expose protected resources.