CVE-2026-88819

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID...

Authentic Credentials Recreation

vp-toolkit is vulnerable to authentic credentials recreation. The verifyVerifiableCredential function fails to correctly verify the credential.issuer DID against the signer of the credential during its cryptographic level integerity check, allowing a malicious holder of the credential to recreate...