JWT is not encrypted by default (only signed), tokens are difficult to actively revoke once issued, and improper key management can lead to wholesale token forgery.