diff --git a/tests/unit/test_auth_service.py b/tests/unit/test_auth_service.py
index 42d1c64bc..b0ffa5477 100755
--- a/tests/unit/test_auth_service.py
+++ b/tests/unit/test_auth_service.py
@@ -456,10 +456,25 @@ class TestJWTService:
             service.verify_token(token)
 
     def test_verify_token_tampered_signature(self, service):
-        """篡改签名的token无法验证"""
+        """篡改payload的token无法验证（签名不匹配）"""
+        import base64
+        import json
+
         token = service.create_access_token(user_id="user_123")
-        # 篡改最后一个字符
-        tampered = token[:-1] + ("A" if token[-1] != "A" else "B")
+        parts = token.split(".")
+        assert len(parts) == 3
+        # 篡改 payload 部分（改用户ID），会导致签名不匹配
+        payload_b64 = parts[1]
+        # 补 padding 以便解码
+        padding = 4 - len(payload_b64) % 4
+        if padding != 4:
+            payload_b64 += "=" * padding
+        payload_bytes = base64.urlsafe_b64decode(payload_b64)
+        payload = json.loads(payload_bytes)
+        payload["sub"] = "hacked_user"
+        new_payload_bytes = json.dumps(payload).encode()
+        new_payload_b64 = base64.urlsafe_b64encode(new_payload_bytes).rstrip(b"=").decode()
+        tampered = f"{parts[0]}.{new_payload_b64}.{parts[2]}"
         with pytest.raises(InvalidTokenError):
             service.verify_token(tampered)