Your new colleague, a security expert, swears this admin endpoint is bulletproof: the JWT is issued by the server, and the code explicitly checks the payload for the admin role.
Now it's in production, and attackers are making themselves admins. What's wrong with it?