This partner login verifies RS256 against a public key it publishes at /.well-known/jwks.json and /keys/public.pem. Present an SSO token as ?sso=<jwt>. A sample RS256 token (role:user) is below — inspect its header, then ask what happens if you hand the verifier an HS256 token whose HMAC key is that public key. Get role:admin in that way.
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InJhdGF1dGgtcnMyNTYtMjAyNiJ9.eyJzdWIiOiJkZW1vIiwidWlkIjoyLCJyb2xlIjoidXNlciIsImV4cCI6MTc4ODA3MjQ1Nn0.Eb-36sDq0rODhMWCIt6bv22UeDwyN8BkF_gh-LBp6lg6xFLMSQkrRNPzY88rDymBdz2lTEh-ZJDmWOhmyPN2gjw4JemIsBeKwt1a2ptupXOZO6UhVScs3xtXbuPhluutP3WcJxIgoHbagmt7LJuJvSZkPZuQiFG22HpmAaoNy1G-bvyfonmwiAnmPrT3MlHxCDeBiLKiCGQpZhHGMwpsxWO5IA6i1iCeE9Sm7mCRHZVcNMZNWAFqzrYDPoxM2ei0obSxCmnZ5LJ11EdORHSBnsJhpbAdJ5MA3BapVmT8zBhs6h0bjnO1jINs6pf75vVOiKywNs0LKLdtyZ4tmjMLPA