There is a bug in the JWS validation code

[OrvarE]

if ((jwtClaims.getClaimValue("digest") != null) && !jwtClaims.getClaimValue("digest").equals(calculateDigestValue(responseBody)))

If the JWS digest is not null and it's NOT equal to the calculated digest then the token is verified.
The digests should I guess be equal to each other? There is a ! after the AND (&&)

if ((jwtClaims.getClaimValue("digest") != null) && jwtClaims.getClaimValue("digest").equals(calculateDigestValue(responseBody)))

So if the JWS digest isn't null and the digests are equal then the token is validated

Located here:
code