{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@sd-jwt/core--0.19.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-62374"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@sd-jwt/decode (\u003c= 0.19.0)","@sd-jwt/core (\u003c= 0.19.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003e@sd-jwt/decode\u003c/code\u003e and \u003ccode\u003e@sd-jwt/core\u003c/code\u003e libraries (version 0.19.0) contain a validation flaw in the disclosure processing layer that deviates from RFC 9901 requirements. The libraries perform a lossy decoding process that silently drops tampered or non-decodable disclosures instead of rejecting the presentation.\u003c/p\u003e\n\u003cp\u003eWhen a disclosure is tampered with (e.g., via byte manipulation or invalid UTF-8 sequences), the library fails to identify the mismatch against the Issuer-signed \u003ccode\u003e_sd\u003c/code\u003e array. Consequently, the library returns a successful verification result containing a reduced claim set. This behavior acts as an omission primitive, potentially allowing holders or on-path attackers to bypass authorization logic that assumes the presence of specific credentials.\u003c/p\u003e\n\u003cp\u003eThe issue specifically violates:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRFC 9901 §7.1 step 5: Mandatory rejection if any disclosure is not referenced by digest in the signed JWT.\u003c/li\u003e\n\u003cli\u003eRFC 9901 §7.1 step 3 / §4.2.1: Mandatory rejection of non-base64url-JSON disclosures.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T21:34:13Z","date_published":"2026-11-02T21:34:13Z","id":"https://feed.craftedsignal.io/briefs/2026-11-sd-jwt-disclosure-downgrade/","summary":"The @sd-jwt/decode and @sd-jwt/core libraries (0.19.0) fail to correctly validate SD-JWT disclosures, allowing an attacker to silently drop tampered claims.","title":"SD-JWT JS: Disclosure omission and validation bypass (CVE-2026-62374)","url":"https://feed.craftedsignal.io/briefs/2026-11-sd-jwt-disclosure-downgrade/"}],"language":"en","title":"CraftedSignal Threat Feed - @Sd-Jwt/Core (\u003c= 0.19.0)","version":"https://jsonfeed.org/version/1.1"}