JavaScript Implementation Vulnerability in SD JWT by Open Wallet Foundation

CVE-2026-62374

What is CVE-2026-62374?

The SD JWT JS library, which implements the Selective Disclosure JWT specification, has a significant flaw where tampered Disclosures can be accepted without proper validation. Specifically, versions 0.19.0 and earlier of the @sd-jwt/decode package and the associated @sd-jwt/core fail to reject Disclosures with mismatched digests or invalid UTF-8 characters. This oversight allows malicious actors to manipulate authorization decisions silently by presenting altered claim sets as legitimate. The issue arises when the relying party does not enforce key binding, which normally prevents on-path tampering. Affected users should upgrade to @sd-jwt/core version 0.20.0 for mitigation, as no patch is available for @sd-jwt/decode.

References