Is NextAuth Credentials safe?

I use next-auth Credentials (v3) to allow my users to register and sign in with good old email and password in my NextJS website. I use MongoDB as my database.

This is my [...nextauth].js file:

export default NextAuth({
  session: {
    jwt: true
  },
  providers: [
    Providers.Credentials({
      async authorize(credentials) {
        await dbConnect();

        // Check if a user with the email exists
        const user = await UserModel.findOne({ email: credentials.email });
        if (!user) throw new Error("Emailen is not in use");

        // Check if the password is correct
        const correctPassword = await bcrypt.compare(
          credentials.password,
          user.password
        );
        if (!correctPassword) throw new Error("Wrong password");

        return {
          userid: user._id,
          email: user.email,
        };
      },
    }),
  ],
  callbacks: {
    // Add userid to token
    async jwt(token, user, account, profile, isNewUser) {
      if (user) {
        token.id = user.userid;
      }
      return token
    },
    // Add userid to session returned to front-end
    async session(session, token) {
      session.user.id = token.id;
      return session
    }
  }
});

Before fetching data in my NextJS API endpoints, I check if the user is authenticated like this:

const session = await getSession({ req });
const user = await UserModel.findById(session?.user?.id);

if (!session || !user)
  return res.status(400).json({ success: false });

But I'm worried that if a person gets the id of another user, they can just edit their JWT session.user.id and access any API endpoint pretending to be another user?

Is that true? Would the users be able to fake their id's in my code?

If so, what can I do to avoid that?