A developer implements role-based access control and checks permissions client-side: 'if (user.role === "admin") showAdminPanel()'. An attacker changes their JWT role to 'admin'. The backend API route '/api/admin/users' does not check the role claim. What OWASP category does this represent at the API level?

• A.A02 Cryptographic Failures: the signature (HS256 with a short secret) was forged, a weakness that all JWT deployments share, whereas the missing role check on the endpoint is a secondary issue (an access rule gap), with stronger keys fixing the flaw at the identity provider that issues the tokens for the API tier
• B.A01 Broken Access Control: the API endpoint fails to enforce authorization. Even if the JWT signature is valid (implying the role claim was legitimately issued), the backend must verify that the requesting user's role permits access to the endpoint - it cannot assume client-side checks are sufficient
• C.A05 Security Misconfiguration: the admin route (/api/admin/users) is exposed in the production build, a default that every framework ships with, with the role claim irrelevant to the finding, the fix being a network rule that hides the route from the public listener of the load balancer in front of the production API cluster