@Sd-Jwt/Decode (<= 0.19.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/@sd-jwt/decode--0.19.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 21:34:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSD-JWT JS: Disclosure omission and validation bypass (CVE-2026-62374)https://feed.craftedsignal.io/briefs/2026-11-sd-jwt-disclosure-downgrade/Mon, 02 Nov 2026 21:34:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-sd-jwt-disclosure-downgrade/The @sd-jwt/decode and @sd-jwt/core libraries (0.19.0) fail to correctly validate SD-JWT disclosures, allowing an attacker to silently drop tampered claims.The @sd-jwt/decode and @sd-jwt/core libraries (version 0.19.0) contain a validation flaw in the disclosure processing layer that deviates from RFC 9901 requirements. The libraries perform a lossy decoding process that silently drops tampered or non-decodable disclosures instead of rejecting the presentation.

When a disclosure is tampered with (e.g., via byte manipulation or invalid UTF-8 sequences), the library fails to identify the mismatch against the Issuer-signed _sd array. Consequently, the library returns a successful verification result containing a reduced claim set. This behavior acts as an omission primitive, potentially allowing holders or on-path attackers to bypass authorization logic that assumes the presence of specific credentials.

The issue specifically violates:

  • RFC 9901 §7.1 step 5: Mandatory rejection if any disclosure is not referenced by digest in the signed JWT.
  • RFC 9901 §7.1 step 3 / §4.2.1: Mandatory rejection of non-base64url-JSON disclosures.
]]>highadvisory