In xml-crypto through 1.5.3 An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. Both HMAC and public key digital signature methods use the same variable to provide the key, and the choice of algorithm is provided by user input. This can result in a security vulnerability. Since HMAC-SHA1 is less commonly used, disable it by default to prevent this issue. If one uses it, you can re-enable it by calling SignedXml.enableHMAC(). The issue is fixed in version 2.0.0.