SD-JWT JS: Disclosure omission and validation bypass (CVE-2026-62374)
The @sd-jwt/decode and @sd-jwt/core libraries (0.19.0) fail to correctly validate SD-JWT disclosures, allowing an attacker to silently drop tampered claims.
CVE search metadata
CVE search record: CVE-2026-62374. EPSS: 0.23%. KEV: no. Product: @sd-jwt/decode (<= 0.19.0), @sd-jwt/core (<= 0.19.0). Brief: SD-JWT JS: Disclosure omission and validation bypass (CVE-2026-62374). Brief link: https://feed.craftedsignal.io/briefs/2026-11-sd-jwt-disclosure-downgrade/
Triage facts
Revision 1- Applicability
- @sd-jwt/decode (<= 0.19.0), @sd-jwt/core (<= 0.19.0)
- Evidence
- Not observed
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 2, 21:34 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The @sd-jwt/decode and @sd-jwt/core libraries (version 0.19.0) contain a validation flaw in the disclosure processing layer that deviates from RFC 9901 requirements. The libraries perform a lossy decoding process that silently drops tampered or non-decodable disclosures instead of rejecting the presentation.
When a disclosure is tampered with (e.g., via byte manipulation or invalid UTF-8 sequences), the library fails to identify the mismatch against the Issuer-signed _sd array. Consequently, the library returns a successful verification result containing a reduced claim set. This behavior acts as an omission primitive, potentially allowing holders or on-path attackers to bypass authorization logic that assumes the presence of specific credentials.
The issue specifically violates:
- RFC 9901 §7.1 step 5: Mandatory rejection if any disclosure is not referenced by digest in the signed JWT.
- RFC 9901 §7.1 step 3 / §4.2.1: Mandatory rejection of non-base64url-JSON disclosures.