Authlib's default implementation of the RFC 7523 JWT bearer grant does not properly validate the 'aud' (audience) claim in JWT assertions. Instead of verifying that the 'aud' claim matches the authorization server's token endpoint, it only checks for the presence of the claim. This allows an attacker with a valid JWT for one audience to use it to obtain access tokens from a different authorization server sharing the same signing key, effectively bypassing audience restrictions.