A JWKS cache-miss flooding attack can force each request to trigger a remote JWKS fetch by forging large numbers of invalid JWTs carrying different kid values, launching a distributed denial-of-service attack against the authorization server.