CVE-2026-62374 Open Wallet Foundation CVE debrief

Who should care

Defenders responsible for SD-JWT implementations, security teams, and developers using the `@sd-jwt/decode` library should be aware of this vulnerability and take steps to verify the integrity of disclosures and update the library to a version that rejects tampered disclosures.

Why it matters

The vulnerability in `@sd-jwt/decode` 0.19.0 allows tampered disclosures to be silently dropped, potentially leading to reduced claim sets being presented to relying parties. Defenders should prioritize verifying disclosure integrity and updating the library.

• Potential for reduced claim set being presented to the relying party
• Possible downgrade attacks through tampered disclosures
• Need for verification of disclosure integrity
• Importance of updating `@sd-jwt/decode` to a version that rejects tampered disclosures

Technical summary

The `@sd-jwt/decode` library, version 0.19.0, does not reject SD-JWT presentations with tampered disclosures. Instead, it silently drops the unmatched disclosure and returns a reduced claim set, reporting success. This behavior is a downgrade/omission primitive that can be exploited by a malicious or curious holder or an in-transit attacker. The vulnerability arises from the library's failure to properly validate the integrity of disclosures, allowing attackers to manipulate the disclosures and have the relying party receive fewer claims than the credential carries.

Defensive priority

Defenders should prioritize verifying the integrity of disclosures and ensuring that the `@sd-jwt/decode` library is updated to a version that rejects tampered disclosures.

Recommended defensive actions

• Verify the integrity of disclosures in SD-JWT presentations
• Update `@sd-jwt/decode` to a version that rejects tampered disclosures
• Monitor for potential downgrade attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported in the `@sd-jwt/decode` library, version 0.19.0. The issue is related to the handling of tampered disclosures in SD-JWT presentations, where the library silently drops unmatched disclosures instead of rejecting them. This behavior can lead to reduced claim sets being presented to relying parties. The vulnerability was identified through a combination of source-provided information and defensive analysis. To verify the vulnerability, defenders should review the library's documentation and update to a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.