      def verify_signature(jwt)
        head = token_head(jwt)

        # Make sure the algorithm is supported and get the decode key.
        if head[:alg] == 'RS256'
          [rs256_decode_key(head[:kid]), head[:alg]]
        elsif head[:alg] == 'HS256'
          [@client_secret, head[:alg]]
        else
          raise OmniAuth::Auth0::TokenValidationError.new("Signature algorithm of #{head[:alg]} is not supported. Expected the ID token to be signed with RS256 or HS256")
        end
      end
The software does not verify, or incorrectly verifies, the cryptographic signature for data.