{"metadata": {"vulnerability": "CVE-2026-62374", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-07-13T22:04:59.678Z", "date_only": false, "value": "2026-07-13T22:04:59.678Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-62374", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-29T16:27:40.825Z", "date_only": false, "value": "2026-10-29T16:27:40.825Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-62374", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T16:27:40.825Z", "date_only": false, "value": "2026-10-29T16:27:40.825Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-62374", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-29T17:18:10Z", "date_only": false, "value": "2026-10-29T17:18:10Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F9J6-8P6X-R9J6", "record": "GHSA-F9J6-8P6X-R9J6", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-29T17:18:10.143Z", "date_only": false, "value": "2026-10-29T17:18:10.143", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-62374", "record": "FKIE_CVE-2026-62374", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T17:48:39.414Z", "date_only": false, "value": "2026-10-29T17:48:39.414384Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117525454444713127", "record": "CVE-2026-62374", "field": "creation_timestamp", "uuid": "02a4f9b3-cb24-4d8a-9e5c-11567ca8f75c", "content": "CVE-2026-62374 SD JWT JS: Tampered disclosures silently dropped instead of rejected SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed `_sd` array and returns a reduced claim set, reporting success while the Issuer signature remains valid. Both a tampered Disclosure that remains valid JSON and a Disclosure containing invalid UTF-8 bytes reach this silent-drop behavior. In the latter case, the `TextDecoder / Buffer` decoding path substitutes U+FFFD replacement characters, recovering syntactically valid disclosure data instead of rejecting the malformed input. This violates RFC 9901 section 7.1 step 5, which requires rejection of unreferenced Disclosures, and section 7.1 step 3 / section 4.2.1, which require rejection of invalid Disclosures. A malicious holder can exploit this omission primitive, including through `SDJwtInstance.verify()` when key binding is required. An on-path attacker can also tamper with a Disclosure when the relying party does not enforce key binding; enforced key binding rejects on-path tampering because it invalidates the KB-JWT `sd_hash` binding. If the relying party defaults to allowing access when a constraining age, role, or restriction claim is absent, the silent claim reduction can change an authorization decision without an error. This issue is fixed in `@sd-jwt/core` version 0.20.0; no patched version of the standalone `@sd-jwt/decode` package is identified.\nhttps://www.cve.org/CVERecord?id=CVE-2026-62374https://github.com/openwallet-foundation/sd-jwt-js/security/advisories/GHSA-f9j6-8p6x-r9j6#openwallet-foundation #@sd-jwt/core #@sd-jwt/decode#CVE_2026_62374#bot", "url": "https://infosec.exchange/users/cve/statuses/117525454444713127"}, {"timestamp": "2026-11-02T17:54:39Z", "date_only": false, "value": "2026-11-02T17:54:39Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F9J6-8P6X-R9J6", "record": "GHSA-F9J6-8P6X-R9J6", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T17:54:39Z", "date_only": false, "value": "2026-11-02T17:54:39Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F9J6-8P6X-R9J6", "record": "GHSA-F9J6-8P6X-R9J6", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-02T19:30:50Z", "date_only": false, "value": "2026-11-02T19:30:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/ddd1b6ae3f04e098219d8b55b7a097b7", "record": "CVE-2026-62374", "field": "creation_timestamp", "uuid": "d80f0438-8b38-4c1a-ae0b-dc573788a6a1", "content": "# CVE-2026-62374: CVE-2026-62374: Silent Claim-Set Reduction and Verification Bypass in SD JWT JS\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-11-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-62374\n\n## Summary\nCVE-2026-62374 (GHSA-f9j6-8p6x-r9j6) is a verification bypass vulnerability in the OpenWallet Foundation SD JWT JS library (@sd-jwt/core and @sd-jwt/decode versions 0.19.0 and earlier). Due to permissive UTF-8 decoding and the omission of mandatory reference checks during presentation verification, tampered or unreferenced disclosures are silently dropped rather than rejected. This deviates from RFC 9901 \u00a77.1 requirements and allows attackers to execute silent claim-set reduction attacks against relying parties.\n\n## TL;DR\nVersions 0.19.0 and earlier of @sd-jwt/core and @sd-jwt/decode fail to reject invalid UTF-8 byte sequences in base64url disclosures and do not verify that all presented disclosures match an Issuer-signed _sd digest. Attackers can corrupt specific disclosures to strip restrictive claims from a credential presentation while still passing cryptographic signature verification.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CVE ID**: CVE-2026-62374 (GHSA-f9j6-8p6x-r9j6)\n- **Primary CWE**: CWE-754 (Improper Check for Unusual Conditions) / CWE-176 (Improper Handling of Unicode Encoding)\n- **CVSS v4.0 Score**: 7.1 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N)\n- **Attack Vector**: Network (Tampered SD-JWT Disclosure Segment)\n- **Impact**: Silent Claim-Set Reduction / Verification Integrity Bypass\n- **Affected Packages**: @sd-jwt/core <= 0.19.0, @sd-jwt/decode <= 0.19.0\n- **Patched Version**: @sd-jwt/core 0.20.0\n- **Exploit & KEV Status**: PoC Available / Not Listed in CISA KEV (EPSS: 0.23%)\n\n## Affected Systems\n\n- @sd-jwt/core (npm)\n- @sd-jwt/decode (npm)\n- **@sd-jwt/core**: <= 0.19.0 (Fixed in: `0.20.0`)\n- **@sd-jwt/decode**: <= 0.19.0 (Fixed in: `Consolidated into @sd-jwt/core 0.20.0`)\n\n## Mitigation\n\n- Upgrade @sd-jwt/core to version 0.20.0 or higher to enforce RFC 9901 \u00a77.1 compliance.\n- Migrate away from the deprecated standalone @sd-jwt/decode package to @sd-jwt/core.\n- Implement fail-closed (default-deny) schema validation on verified claim payloads at the Relying Party.\n- Enforce Holder Key Binding (KB-JWT) to protect disclosure integrity against on-path tampering.\n\n**Remediation Steps:**\n1. Audit project dependencies (package.json and lockfiles) for @sd-jwt/core and @sd-jwt/decode versions <= 0.19.0.\n2. Run `npm uninstall @sd-jwt/decode` if the standalone decode package is directly installed.\n3. Run `npm install @sd-jwt/core@^0.20.0` or `pnpm update @sd-jwt/core@^0.20.0`.\n4. Update TypeScript/JavaScript import paths from `@sd-jwt/decode` to `@sd-jwt/core`.\n5. Verify that unit and integration tests pass and confirm that malformed disclosures throw SDJWTException.\n\n## References\n\n- [GitHub Security Advisory: GHSA-f9j6-8p6x-r9j6](https://github.com/openwallet-foundation/sd-jwt-js/security/advisories/GHSA-f9j6-8p6x-r9j6)\n- [NVD - CVE-2026-62374](https://nvd.nist.gov/vuln/detail/CVE-2026-62374)\n- [CVE Record: CVE-2026-62374](https://www.cve.org/CVERecord?id=CVE-2026-62374)\n- [GitHub Pull Request #380](https://github.com/openwallet-foundation/sd-jwt-js/pull/380)\n- [Fix Commit 3d8a72a0a279d67439db038c9c2b52621568b866](https://github.com/openwallet-foundation/sd-jwt-js/commit/3d8a72a0a279d67439db038c9c2b52621568b866)\n- [OpenWallet Foundation SD-JWT-JS Repository](https://github.com/openwallet-foundation/sd-jwt-js)\n- [RFC 9901: Selective Disclosure for JSON Web Tokens](https://www.rfc-editor.org/rfc/rfc9901.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-62374) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/ddd1b6ae3f04e098219d8b55b7a097b7"}, {"timestamp": "2026-11-04T01:30:21.510Z", "date_only": false, "value": "2026-11-04T01:30:21.510953Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-62374", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-04T01:30:21.510Z", "date_only": false, "value": "2026-11-04T01:30:21.510953Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-62374", "record": "FKIE_CVE-2026-62374", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-04T01:30:47.511Z", "date_only": false, "value": "2026-11-04T01:30:47.511Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-62374", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-04T01:30:47.511Z", "date_only": false, "value": "2026-11-04T01:30:47.511Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-62374", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-04T02:17:21.003Z", "date_only": false, "value": "2026-11-04T02:17:21.003", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-62374", "record": "FKIE_CVE-2026-62374", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T20:55:43.946Z", "anchors": {"origin": {"timestamp": "2026-10-29T16:27:40.825Z", "date_only": false, "value": "2026-10-29T16:27:40.825Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-62374", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-29T16:27:40.825Z", "date_only": false, "value": "2026-10-29T16:27:40.825Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-62374", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 620883.12187, "hours": 172.4675338527778, "days": 7.186147243865741, "min_seconds": 620883.12187, "max_seconds": 620883.12187, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-29T16:27:40.825Z", "date_only": false, "value": "2026-10-29T16:27:40.825Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-62374", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T20:55:43.946Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}