	private static void validate(final byte[] iv, final int authTagLength)
		throws JOSEException {
		
		if (ByteUtils.safeBitLength(iv) != IV_BIT_LENGTH) {
			throw new JOSEException(String.format("IV length of %d bits is required, got %d", IV_BIT_LENGTH, ByteUtils.safeBitLength(iv)));
		}

		if (authTagLength != AUTH_TAG_BIT_LENGTH) {
			throw new JOSEException(String.format("Authentication tag length of %d bits is required, got %d", AUTH_TAG_BIT_LENGTH, authTagLength));
		}
	}
The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.