It has been 29 days since the last alg:none JWT vulnerability.

authlib, a Python library for OAuth and OpenID Connect, among a swathe of recently reported bugs, skipped validation of JWTs if no signatures were provided at all.