GHSA-ff5x-w9wg-h275
Holder can generate proof of ownership for credentials it does not control in vp-toolkit
GHSA-ff5x-w9wg-h275 is a vulnerability with no CVSS score yet in vp-toolkit, published March 6, 2020. No source lists public exploit code. Fixed in vp-toolkit 0.2.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.2.2vp-toolkit
Description
Impact
The verifyVerifiablePresentation() method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the credentialSubject.id DID matches the signer of the VP proof.
The verifier is impacted by this vulnerability.
Patches
Patch will be available in version 0.2.2.
Workarounds
- Compute the address out of the
verifiablePresentation.proof.n.verificationMethodusinggetAddressFromPubKey()fromcrypt-util@0.1.5and match it with thecredentialSubject.idaddress from the credential.
References
For more information
If you have any questions or comments about this advisory:
- Discuss in the existing issue
- Contact me
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vp-toolkitnpm | before 0.2.2 | 0.2.2 |
What each source reports
GitHub AdvisoriesNo score
Holder can generate proof of ownership for credentials it does not control in vp-toolkit
Impact
The verifyVerifiablePresentation() method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the credentialSubject.id DID matches the signer of the VP proof.
The verifier is impacted by this vulnerability.
Patches
Patch will be available in version 0.2.2.
Workarounds
- Compute the address out of the
verifiablePresentation.proof.n.verificationMethodusinggetAddressFromPubKey()fromcrypt-util@0.1.5and match it with thecredentialSubject.idaddress from the credential.
References
For more information
If you have any questions or comments about this advisory:
- Discuss in the existing issue
- Contact me
- Record
GHSA-ff5x-w9wg-h275- Updated
- 2026-11-02
OSVNo score
Holder can generate proof of ownership for credentials it does not control in vp-toolkit
Impact
The verifyVerifiablePresentation() method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the credentialSubject.id DID matches the signer of the VP proof.
The verifier is impacted by this vulnerability.
Patches
Patch will be available in version 0.2.2.
Workarounds
- Compute the address out of the
verifiablePresentation.proof.n.verificationMethodusinggetAddressFromPubKey()fromcrypt-util@0.1.5and match it with thecredentialSubject.idaddress from the credential.
References
For more information
If you have any questions or comments about this advisory:
- Discuss in the existing issue
- Contact me
- Record
GHSA-ff5x-w9wg-h275- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.