Description
The verifyVerifiablePresentation() method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the credentialSubject.id DID matches the signer of the VP proof.
The verifier is impacted by this vulnerability.
Recommendation
Update the vp-toolkit package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.2.2
- Patched version(s): 0.2.2
References
Could your website be exposed too?
SmartScanner can check your website for Holder can generate proof of ownership for credentials it does not control in vp-toolkit and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Holder can (re)create authentic credentials after receiving a credential in vp-toolkit - Vulnerability
- Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change - Vulnerability
- Axios: Nested axios option objects can consume polluted prototype values - Vulnerability
- Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials) - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023