The @decido/backend-core npm package contains hardcoded authentication tokens that bypass JWT verification. Specifically, the middleware accepts the literal strings 'mock-admin-token' and 'mock-token-123' as valid credentials, granting ADMIN and STUDENT access respectively without proper validation. This allows any client sending these tokens to gain unauthorized administrative or student-level access to applications using this middleware.