That’s the main flaw in server-side signature was not validating that’s why this issue has occurred.