A DESCRIPTION OF THE PROBLEM :
Per https://www.oracle.com/technical-resources/articles/java/javadoc-tool.html "In the absence of explicit indication to the contrary, all objects are assumed to be "thread-safe" (i.e., it is permissible for multiple threads to access them concurrently)."

Unfortunately, javax.crypto.Mac is not threadsafe, but its javadoc does not mention this! The javadoc should be updated to make it clear.