	public static SecretKey decryptCEK(final SecretKey kek,
					   final byte[] iv,
					   final AuthenticatedCipherText authEncrCEK,
					   final int keyLength,
					   final Provider provider)
		throws JOSEException {

		byte[] keyBytes = AESGCM.decrypt(kek, iv, authEncrCEK.getCipherText(), new byte[0], authEncrCEK.getAuthenticationTag(), provider);

		if (ByteUtils.safeBitLength(keyBytes) != keyLength) {

			throw new KeyLengthException("CEK key length mismatch: " + ByteUtils.safeBitLength(keyBytes) + " != " + keyLength);
		}

		return new SecretKeySpec(keyBytes, "AES");
	}
The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.