Penetration Testing Finding - JWT is encoded using Base64

Question

We are using OpenIDConnect in our application for authentication and authorization. The generated ID token is in JWT format and is stored in a cookie in httpOnly mode.

We