{"id":"CVE-2026-62374","kind":"vulnerability","aliases":["CVE-2026-62374"],"related":[],"title":"SD-JWT JS: tampered disclosures silently dropped, claims reduced without error","description":"SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed `_sd` array and returns a reduced claim set, reporting success while the Issuer signature remains valid. Both a tampered Disclosure that remains valid JSON and a Disclosure containing invalid UTF-8 bytes reach this silent-drop behavior. In the latter case, the `TextDecoder / Buffer` decoding path substitutes U+FFFD replacement characters, recovering syntactically valid disclosure data instead of rejecting the malformed input. This violates RFC 9901 section 7.1 step 5, which requires rejection of unreferenced Disclosures, and section 7.1 step 3 / section 4.2.1, which require rejection of invalid Disclosures. A malicious holder can exploit this omission primitive, including through `SDJwtInstance.verify()` when key binding is required. An on-path attacker can also tamper with a Disclosure when the relying party does not enforce key binding; enforced key binding rejects on-path tampering because it invalidates the KB-JWT `sd_hash` binding. If the relying party defaults to allowing access when a constraining age, role, or restriction claim is absent, the silent claim reduction can change an authorization decision without an error. This issue is fixed in `@sd-jwt/core` version 0.20.0; no patched version of the standalone `@sd-jwt/decode` package is identified.","summary":"In SD JWT JS version 0.19.0 and earlier, the decoder silently discards a Disclosure whose digest does not match the signed claims and still reports the token as valid. A malicious holder, or an on-path attacker where key binding is not enforced, can remove claims and change an authorization decision without an error.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","javascript","node","package","sd-jwt"],"not_affected_if":["key-binding-enforced","no-sd-jwt-verification"],"how_to_check":"- Check the installed version of `@sd-jwt/core` and `@sd-jwt/decode` in your lockfile, for example `npm ls @sd-jwt/core @sd-jwt/decode`.\n- Look for code that relies on `SDJwtInstance.verify()` results to grant access when an age, role or restriction claim is missing.\n- Check whether key binding is required on your verification path.","fix":"- `@sd-jwt/core` to `0.20.0`\n- `@sd-jwt/decode`: no patched version identified","status":"open","published_at":"2026-10-29T17:18:10+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","triaged_at":"2026-10-29T17:27:57+00:00","updated_at":"2026-10-29T17:27:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T17:27:57Z","model":"claude-haiku-5-5","output":{"fix":"- `@sd-jwt/core` to `0.20.0`\n- `@sd-jwt/decode`: no patched version identified","reach":"network","title":"SD-JWT JS: tampered disclosures silently dropped, claims reduced without error","impact":"medium","summary":"In SD JWT JS version 0.19.0 and earlier, the decoder silently discards a Disclosure whose digest does not match the signed claims and still reports the token as valid. A malicious holder, or an on-path attacker where key binding is not enforced, can remove claims and change an authorization decision without an error.","audience":"developers","category":"package","nicknames":[],"who_cares":["node","sd-jwt","javascript","identity"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Claims silently removed, authorization decisions changed without any error","analyst_note":"Confirm whether @sd-jwt/decode has a patched version; the sources say none is identified, and the fix list depends on it.","how_to_check":"- Check the installed version of `@sd-jwt/core` and `@sd-jwt/decode` in your lockfile, for example `npm ls @sd-jwt/core @sd-jwt/decode`.\n- Look for code that relies on `SDJwtInstance.verify()` results to grant access when an age, role or restriction claim is missing.\n- Check whether key binding is required on your verification path.","plain_action":"","needs_analyst":true,"not_affected_if":["key-binding-enforced","no-sd-jwt-verification"],"who_is_affected":"Applications that verify SD-JWT credentials with the SD JWT JS libraries and make authorization decisions from the claims they return. Exposure is highest where a missing claim defaults to allowing access, and where key binding is not enforced so an on-path attacker can tamper with Disclosures. Systems that do not use SD-JWT verification through these packages can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000806,"input_tokens":4582,"output_tokens":696,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-62374':15A,18A '-8':157C '/core':112C,309C '/decode':105C,321C '0.19.0':31B,99C '0.20.0':311C '3':208C '4.2.1':210C '5':197C '7.1':195C,206C '9901':193C 'absent':288C 'access':278C 'age':282C 'allow':277C 'also':106C,239C 'array':128C 'attack':63B,237C 'author':76B,296C 'behavior':164C 'bind':66B,230C,252C,255C,270C 'buffer':171C 'byte':158C 'case':168C 'chang':74B,294C 'charact':178C 'claim':9A,47B,72B,133C,286C,291C 'constrain':281C 'contain':154C 'cve':13A,16A 'data':183C 'decis':77B,297C 'decod':35B,172C 'default':275C 'digest':41B,119C 'discard':37B 'disclosur':6A,39B,91C,117C,146C,153C,182C,203C,216C,243C 'drop':8A,114C,163C 'earlier':33B,101C 'enforc':69B,250C,253C 'error':12A,80B,300C 'exploit':221C 'fffd':176C 'fix':304C 'hash':269C 'holder':57B,219C 'ident':19B 'identifi':324C 'implement':87C 'includ':225C 'input':189C 'instead':184C 'invalid':155C,215C,263C 'issu':302C 'issuer':125C,139C 'issuer-sign':124C 'javascript':20B,86C 'js':4A,29B,83C 'json':150C 'jwt':3A,25B,28B,82C,92C,95C,104C,111C,267C,308C,320C 'kb':266C 'kb-jwt':265C 'key':65B,229C,251C,254C 'latter':167C 'longer':121C 'malform':188C 'malici':56B,218C 'match':44B,122C 'node':21B 'omiss':223C 'on-path':60B,234C,257C 'packag':22B,322C 'parti':247C,274C 'patch':313C 'path':62B,173C,236C,259C 'primit':224C 'reach':159C 'recov':179C 'reduc':10A,132C 'reduct':292C 'reject':186C,200C,213C,256C 'reli':246C,273C 'remain':141C,148C 'remov':71B 'replac':177C 'report':50B,135C 'requir':199C,212C,232C 'restrict':285C 'return':130C 'rfc':192C 'role':283C 'sd':2A,24B,27B,81C,94C,103C,110C,127C,268C,307C,319C 'sd-jwt':1A,23B,93C,102C,109C,306C,318C 'sdjwtinstance.verify':227C 'section':194C,205C,209C 'select':90C 'set':134C 'sign':46B,126C 'signatur':140C 'silent':7A,36B,113C,162C,290C 'silent-drop':161C 'specif':96C 'standalon':317C 'step':196C,207C 'still':49B 'substitut':174C 'success':136C 'syntact':180C 'tamper':5A,116C,145C,240C,260C 'textdecod':170C 'token':52B 'u':175C 'unreferenc':202C 'use':107C 'utf':156C 'valid':54B,142C,149C,181C 'version':30B,98C,310C,314C 'violat':191C 'whose':40B,118C 'without':11A,78B,298C","nicknames":[],"mitigations":[],"who_affected":"Applications that verify SD-JWT credentials with the SD JWT JS libraries and make authorization decisions from the claims they return. Exposure is highest where a missing claim defaults to allowing access, and where key binding is not enforced so an on-path attacker can tamper with Disclosures. Systems that do not use SD-JWT verification through these packages can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T17:18:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62374","severity":null,"published_at":"2026-10-29T17:18:10+00:00","modified_at":"2026-10-29T17:18:10+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","fetched_at":"2026-10-29T17:26:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}