Your public JWKS is leaking your PRIVATE key
What it means
The JWKS URL publishes private key fields (e.g. "d"). Anyone can sign as your app.
Fix
Remove it now, rotate to a new key pair, and register the new public key. Treat the old key as compromised.
Check it with smart-doctor
Run your login and smart-doctor ranks this cause against the others, with the evidence it found.
npx smart-doctor check my-profile