Once issued, a JWT cannot be individually revoked before it expires (unless the server additionally maintains a token blacklist), meaning that a third party who obtains a valid JWT can freely use it for the duration of its lifecycle.