CVE-2026-62374: Silent Claim-Set Reduction and Verification Bypass in SD JWT JS

Vulnerability ID: CVE-2026-62374
CVSS Score: 7.1
Published: 2026-11-02

CVE-2026-62374 (GHSA-f9j6-8p6x-r9j6) is a verification bypass vulnerability in the OpenWallet Foundation SD JWT JS library (@sd-jwt/core and @sd-jwt/decode versions 0.19.0 and earlier). Due to permissive UTF-8 decoding and the omission of mandatory reference checks during presentation verification, tampered or unreferenced disclosures are silently dropped rather than rejected. This deviates from RFC 9901 §7.1 requirements and allows attackers to execute silent claim-set reduction attacks against relying parties.

TL;DR

Versions 0.19.0 and earlier of @sd-jwt/core and @sd-jwt/decode fail to reject invalid UTF-8 byte sequences in base64url disclosures and do not verify that all presented disclosures match an Issuer-signed _sd digest. Attackers can corrupt specific disclosures to strip restrictive claims from a credential presentation while still passing cryptographic signature verification.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-62374 (GHSA-f9j6-8p6x-r9j6)
Primary CWE: CWE-754 (Improper Check for Unusual Conditions) / CWE-176 (Improper Handling of Unicode Encoding)
CVSS v4.0 Score: 7.1 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N)
Attack Vector: Network (Tampered SD-JWT Disclosure Segment)
Impact: Silent Claim-Set Reduction / Verification Integrity Bypass
Affected Packages: @sd-jwt/core <= 0.19.0, @sd-jwt/decode <= 0.19.0
Patched Version: @sd-jwt/core 0.20.0
Exploit & KEV Status: PoC Available / Not Listed in CISA KEV (EPSS: 0.23%)

Affected Systems

@sd-jwt/core (npm)
@sd-jwt/decode (npm)
@sd-jwt/core: <= 0.19.0 (Fixed in: 0.20.0)
@sd-jwt/decode: <= 0.19.0 (Fixed in: Consolidated into @sd-jwt/core 0.20.0)

Code Analysis

Commit: 3d8a72a

Enforce strict UTF-8 JSON decoding on disclosures and reject unreferenced or duplicate disclosure digests per RFC 9901.

--- a/packages/core/src/utils/disclosure.ts +++ b/packages/core/src/utils/disclosure.ts - const item = JSON.parse(base64urlDecode(s)) as DisclosureData<T>; + const item = decodeBase64urlJsonStrict<DisclosureData<T>>( + s, + 'Invalid disclosure data', + );  --- a/packages/core/src/decode/decode.ts +++ b/packages/core/src/decode/decode.ts  export const unpackObj = (obj: unknown, map: Record<string, Disclosure>) => { const copiedObj = JSON.parse(JSON.stringify(obj)); const seenDigests = new Set<string>(); const result = unpackObjInternal(copiedObj, map, '', seenDigests); + + // RFC 9901 Section 7.1 step 5: reject unreferenced disclosures + const mapDigests = Object.keys(map); + const unusedDigests = mapDigests.filter((d) => !seenDigests.has(d)); + if (unusedDigests.length > 0) { + throw new SDJWTException('Unreferenced disclosure(s) detected in SD-JWT'); + } +  return result; };

Exploit Details

GitHub: Unit test and reproduction case demonstrating byte tampering (0xF2 injection) in pull request #380.
GitHub Advisory: Official GitHub Security Advisory detailing the silent claim-set reduction mechanism and differential fuzzing results.

Mitigation Strategies

Upgrade @sd-jwt/core to version 0.20.0 or higher to enforce RFC 9901 §7.1 compliance.
Migrate away from the deprecated standalone @sd-jwt/decode package to @sd-jwt/core.
Implement fail-closed (default-deny) schema validation on verified claim payloads at the Relying Party.
Enforce Holder Key Binding (KB-JWT) to protect disclosure integrity against on-path tampering.

Remediation Steps:

Audit project dependencies (package.json and lockfiles) for @sd-jwt/core and @sd-jwt/decode versions <= 0.19.0.
Run npm uninstall @sd-jwt/decode if the standalone decode package is directly installed.
Run npm install @sd-jwt/core@^0.20.0 or pnpm update @sd-jwt/core@^0.20.0.
Update TypeScript/JavaScript import paths from @sd-jwt/decode to @sd-jwt/core.
Verify that unit and integration tests pass and confirm that malformed disclosures throw SDJWTException.