WS-2020-0048

The ""verifyVerifiableCredential"" https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-credential-signer.tsL57 method check the cryptographic integrity of the Verifiable Credential, but it does not check if the ""credential.issuer""...

Authentic Credentials Recreation

vp-toolkit is vulnerable to authentic credentials recreation. The verifyVerifiableCredential function fails to correctly verify the credential.issuer DID against the signer of the credential during its cryptographic level integerity check, allowing a malicious holder of the credential to recreate...

PT-2020-21433

Name of the Vulnerable Software and Affected Versions vp-toolkit versions prior to 0.2.2 Description The verifyVerifiableCredential method does not check if the credential.issuer DID matches the signer of the credential, which impacts the verifier. Recommendations For versions prior to 0.2.2,...