The `oidcProvider` and `mcp` plugins contain insecure cryptographic defaults. The discovery document advertises the `none` algorithm in `id token signing alg values supported` (and `resource signing alg values supported` for the `mcp` plugin), which may allow relying parties that perform algorithm negotiation without pinning to a specific signing algorithm to accept unsigned tokens. Additionally, the plugins enable PKCE `plain` by default. The authorize handler accepts `code challenge method=plain` or silently downgrades missing `code challenge method` parameters to `plain`, which fails to protect authorization codes if the URL is exposed to unauthorized parties. This behavior contradicts the advertised `S256` method and violates OAuth 2.1 standards.