Authentication bypass via default unsigned JWT acceptance

Improper JWT signature verification in Authlib 1.6.5 through 1.6.6 allows remote attackers to forge accepted tokens without a signature. The module-level authlib.jose.jwt instance registered the JWS none algorithm by default, so jwt.decode accepted an alg:none token with an empty signature. Exploitation requires an application to use that default decoder for authentication or authorization, enabling unauthorized access or actions under attacker-chosen claims.