Client impersonation via ambiguous JWT audience

Authentication bypass in IETF RFC 7523 allows remote attackers to impersonate OAuth clients through crafted authorization-server metadata. The specification permits a token-endpoint URL as the JWT audience, so a malicious authorization server can advertise an honest server's endpoint and induce a client to sign an assertion accepted there. Exploitation requires a client that uses the same signing key with at least two authorization servers and interacts with an attacker-controlled server; the assertion enables client impersonation and unauthorized access to user resources.