I was finally able to get back to this today. After doing some additional debugging, the same problem exists in AccessTokenLoader:

Likewise, the service arguments are set here:

The service is expecting the encryption algorithms and associated keysets to be null but are empty strings instead. Therefore, verification always fails.

The easiest solution in both cases would probably be to make sure the appropriate arguments are set to null if they aren't set in the configuration.

Workaround

I've been able to fix both of these issues in my Kernel class by implementing CompilerPassInterface and directly overriding the default values as described in the Symfony documentation: How to Work with Compiler Passes.

// src/Kernel.php
namespace App;

use Symfony\Bundle\FrameworkBundle\Kernel\MicroKernelTrait;
use Symfony\Component\DependencyInjection\Compiler\CompilerPassInterface;
use Symfony\Component\DependencyInjection\ContainerBuilder;
use Symfony\Component\HttpKernel\Kernel as BaseKernel;

class Kernel extends BaseKernel implements CompilerPassInterface
{
    use MicroKernelTrait;
    
    // ...

    public function process(ContainerBuilder $container): void
    {
        $accessTokenBuilderService = 'lexik_jwt_authentication.access_token_builder';
        $accessTokenLoaderService = 'lexik_jwt_authentication.access_token_loader';

        if ($container->hasDefinition($accessTokenBuilderService)) {
            $container->getDefinition($accessTokenBuilderService)
                ->replaceArgument(5, null)
                ->replaceArgument(6, null)
                ->replaceArgument(7, null);
        }

        if ($container->hasDefinition($accessTokenLoaderService)) {
            $container->getDefinition($accessTokenLoaderService)
                ->replaceArgument(9, null)
                ->replaceArgument(10, null)
                ->replaceArgument(11, null)
                ->replaceArgument(12, null);
        }
    }

    // ...
}

This doesn't solve the core problem, but it's a reasonable and easy to implement workaround until it is fixed.

Thanks for the detailed report and workaround!
I'm going to look into this asap though you're welcome if you feel like trying to fix the root cause :)

You're welcome! I've created a pull request that addresses the root cause. Setting default values for the problematic arguments in the service configurations and changing the logic to look for empty arrays instead of null in AccessTokenLoader are the only changes that were needed.

This fix was originally suggested in #1209, but it wasn't fully implemented in #1214. Empty strings were set as default values and the logic wasn't updated in AccessTokenLoader to address the empty arrays.

Are there any updates on this? Is there anything you'd like changed/reworked in the pull request I created?

I'm using the workaround I described above in projects that use this bundle and that's continued to work well. So, there's absolutely no rush. But it'd be nice to not have to use a compiler pass to fix the configuration.