Cursor AI's auth fix creates security flaw by using JWT decode over verify

Cursor AI, when asked to resolve a build error in a Next.js app, replaced a failing `jwt.verify()` call with `jwt.decode()`. The `decode` function reads a JWT's payload without verifying its cryptographic signature, rendering the authentication check ineffective. This allows a malicious user to alter the token's payload, such as changing their role to 'admin', and gain unauthorized access. The vulnerability is a known security weakness classified as CWE-347, Improper Verification of Cryptographic Signature.