It is a rare case but I found an example that ｛”aud”: null ｝is set.
According to RFC7519(JWT), it is usually a list of strings or a string, but there is no specification about the type of "aud".

Expected Result

{"aud": null} should be treated the same as unspecified.

Actual Result

If the ”aud” parameter is not specified, an error will occur.

Reproduction Steps

See https://dgcg.covidbevis.se/tp/

public key:
https://dgcg.covidbevis.se/tp/cert

JWT:
https://dgcg.covidbevis.se/tp/trust-list