Very interesting blog post. Cannot rule out any! Some years back SAML implementations had some of them.

A good read along with this — defines best practices in handling JWTs: https://tools.ietf.org/html/draft-ietf-oauth-jwt-bcp-07