JSON Web Token Security

Malicious JWT to get all users

The atacker creaters their own JWT and set the role to “admin”, and get access to all users in the database. What is wrong with the code below?

app.get("/admin/users", async function getUsers(req, res) {
  const { role } = jwt.decode(req.headers.authorization);

  if (role === "admin")
    return res.json(await db.Users());

  return res.status(403).json({ error: "Forbidden" });
})

The auth token is being decoded, but its signature is never verified. It only checks that the role is “admin”.