Description
When one Disclosure in an SD-JWT presentation is tampered so its digest no longer matches the Issuer-signed _sd array, @sd-jwt/decode 0.19.0 does not reject the presentation. It silently drops the unmatched Disclosure and returns a reduced claim set, reporting success. The Issuer signature is untouched and valid.
Recommendation
Update the @sd-jwt/core package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.19.0
- Patched version(s): 0.20.0
References
Could your website be exposed too?
SmartScanner can check your website for SD JWT JS: Tampered disclosures silently dropped instead of rejected and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SD JWT JS: Tampered disclosures silently dropped instead of rejected - @sd-jwt/decode - CVE-2026-62374
- sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced - CVE-2026-48815
- xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content - CVE-2026-83611
- xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content - xmldom - CVE-2026-83611
You might also like:
See something that needs correcting? Let us knowUpdated November 02, 2026