Impact

If you are not using the jwt_refresh feature, there is no impact.

If you are using the jwt_refresh feature, and are setting allow_refresh_with_expired_jwt_access_token? true in your Rodauth configuration, and an attacker gets access to a expired access token, they can use that expired access token to create valid access tokens without access to a valid access token or valid refresh token.

Note that without allow_refresh_with_expired_jwt_access_token? true being set, if the attacker gets access to a valid access token, they can use that valid access token to create additional valid access tokens without access to a valid refresh token. They would allow an attacker to convert temporary access to an account into permanent access, until there was a token clearing event for the account.