WS-2016-0074

Signature replacement attack in the jsjws package allows attackers to bypass the verification step if a server is expecting a token signed with RSA, but actually receives a token signed with HMAC...