GMS-2015-6: JWT Verification bypass

It is possible for an attacker to bypass verification when “a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family)”. It is also possible for an attacker to create his own signed token with any payload he wants and have it considered valid using the “none” algorithm.