A JSON Web Token is three base64 segments and a signature over the first two. Everything about it is readable by anybody holding it, which is fine, and everything about it is writable by anybody holding it, which is the part that matters — including the header that says which algorithm the signature uses.
So a verifier that reads the algorithm out of the token is asking the suspect to nominate the detective. The none algorithm exists, it is in the specification, and it needs no key at all.
GET /meA token nobody signed, claiming to be the administrator. Decode the middle segment yourself; it is not encrypted.
The other two are absences rather than mistakes. A signing key short enough to be in a wordlist means a valid signature costs an afternoon; no amount of correct verification makes a four-letter secret safe. And an exp claim that is set but never checked means a token issued once works for ever, which makes every token that has ever leaked still live.
Both are invisible in review, because there is nothing wrong on the screen. What is wrong is a line that is not there and a string that is too short.