A token with header "alg": "none" and nothing after the second dot is a valid "unsecured JWS". In March 2015 Tim McLean showed that several popular JWT libraries treated it as just another algorithm, so attackers could strip a signature, set none and have arbitrary claims accepted; RFC 8725 §2.1 describes the attack.
Modern libraries reject none unless the caller opts in, and an explicit algorithm allowlist (for example only ES256) excludes it by construction. Watch for case variants (None, NONE) in hand-written checks, verifiers that call a "decode" function instead of "verify", and middleware that skips verification when the signature part is empty.