You misunderstand the bug, the exploit allows an attacker to generate an apple-signed JWT with an email address of the attacker's choice.