Yes. A JWT payload is base64url-encoded, not encrypted: anyone holding the token can read every claim in it, and this app does exactly that without a key. Signing proves a token was not altered and says who issued it — it hides nothing at all. If a payload genuinely has to be secret that is JWE, a different construction from the signed JWTs almost everyone means. Never put a password, a card number or anything else private in one.
Also what the three segments are, what the alg header has been abused for, when an HMAC is enough and when a public-key signature is the only sensible answer, and why an expiry matters more than it looks.