Skip to content
Threat Feed
Subscribe

Product

@Sd-Jwt/Decode (<= 0.19.0)

1 brief RSS
high advisory

SD-JWT JS: Disclosure omission and validation bypass (CVE-2026-62374)

The @sd-jwt/decode and @sd-jwt/core libraries (0.19.0) fail to correctly validate SD-JWT disclosures, allowing an attacker to silently drop tampered claims.

@sd-jwt/decode +1
1c