paskia/util/oidjwt.py

@@ -186,17 +186,22 @@ def decode_access_token(
     """
     _ensure_key()
     try:
-        # Don't pass audience if None to avoid PyJWT audience validation
+        # PyJWT requires audience parameter when token has aud claim.
+        # When audience is None, we skip PyJWT's audience validation and validate manually.
+        options = {}
         decode_kwargs = {
             "algorithms": ["EdDSA"],
             "issuer": issuer,
         }
         if audience is not None:
             decode_kwargs["audience"] = audience
+        else:
+            options["verify_aud"] = False
             
         return jwt.decode(
             token,
             _public_key,
+            options=options,
             **decode_kwargs
         )
     except jwt.PyJWTError as e: