From that I believe we may be able to imply if the token contains no "kid" then all keys should be used to find one which verifies the signature.

JWT is rejected if signature matching public key is not first in JWK set ------------------------------------------------------------------------ Key: WFWIP-294 URL: https://issues.redhat.com/browse/WFWIP-294 Project: WildFly WIP Issue Type: Bug Components: MP JWT Reporter: Jan Kasik Assignee: Darran Lofthouse Priority: Blocker Attachments: jwks.json, jwt.base64 When public key on remote server is configured to be JWK set, the JWT which has correctly configured key ID to aim on matching public key from the set is rejected if matching public key is not on first position in the set array. Attached is "flawed" key set with "blue-key" placed on first position in array when JOSE header has {{kid}} set to "orange-key" and JWT itself is signed by private key which is from "orange" key pair.