EUVD-2026-113215

SD JWT JS: Tampered disclosures silently dropped instead of rejected...

CVE-2026-62374 SD JWT JS: Tampered disclosures silently dropped instead of rejected

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

CVE-2026-62374: openwallet-foundation: SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...