Signature counter in the assertion is too high. This could mean either an implementation error on the client, or a compromised client app.