EUVD-2026-113215

SD JWT JS: Tampered disclosures silently dropped instead of rejected...

CVE-2026-62374

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

CVE-2026-62374 SD JWT JS: Tampered disclosures silently dropped instead of rejected

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

CVE-2026-62374

The SD JWT JS JavaScript implementation of the Selective Disclosure JWT specification contains a vulnerability in version 0.19.0 and earlier . Specifically, the @sd-jwt/decode component (used by @sd-jwt/core) silently drops tampered Disclosures instead of rejecting them. When a Disclosure's diges...

CVE-2026-62374

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, "@sd-jwt/decode", also used by "@sd-jwt/core", silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed "sd" array and returns a reduced claim...

CVE-2026-62374 SD JWT JS: Tampered disclosures silently dropped instead of rejected

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

PT-2026-132399

Name of the Vulnerable Software and Affected Versions @sd-jwt/core versions prior to 0.20.0 @sd-jwt/decode versions prior to 0.20.0 Description In the @sd-jwt/decode component, also utilized by @sd-jwt/core, the system silently drops tampered Disclosures if their digest does not match the...

CVE-2026-62374: openwallet-foundation: SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...