JWT
Also called JSON Web Token, alg none
A login token the server signs and the browser sends back. It has three parts: header, payload, signature. The payload is only encoded, so anyone can read it. The signature proves it hasn't been changed, if the server checks it properly.
The header says which algorithm was used, and the attacker writes the header. A verifier that believes it can be told no signature is needed. And a guessable key can be cracked offline, with nothing to notice it.
Say it to your agent
“Verify with a maintained library and pin algorithms to ['HS256'], with a key of 32 random bytes from the secret manager. Add tests that reject an edited payload and an alg: none token. Put nothing private in the payload, because it's readable.”