Citi interview question

How would you attack an application that uses a JWT?