GHSA-p94w-42g3-f7h4
Holder can (re)create authentic credentials after receiving a credential in vp-toolkit
GHSA-p94w-42g3-f7h4 is a vulnerability with no CVSS score yet in vp-toolkit, published March 6, 2020. No source lists public exploit code. Fixed in vp-toolkit 0.2.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.2.2vp-toolkit
Description
Impact
The verifyVerifiableCredential() method check the cryptographic integrity of the Verifiable Credential, but it does not check if the credential.issuer DID matches the signer of the credential.
The verifier is impacted by this vulnerability.
Patches
Patch will be available in version 0.2.2.
Workarounds
In case you trust certain issuers for certain credentials as a verifier, trust the issuer's public key from the credential.proof.verificationMethod field.
References
For more information
If you have any questions or comments about this advisory:
- Discuss in the existing issue
- Contact me
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vp-toolkitnpm | before 0.2.2 | 0.2.2 |
What each source reports
GitHub AdvisoriesNo score
Holder can (re)create authentic credentials after receiving a credential in vp-toolkit
Impact
The verifyVerifiableCredential() method check the cryptographic integrity of the Verifiable Credential, but it does not check if the credential.issuer DID matches the signer of the credential.
The verifier is impacted by this vulnerability.
Patches
Patch will be available in version 0.2.2.
Workarounds
In case you trust certain issuers for certain credentials as a verifier, trust the issuer's public key from the credential.proof.verificationMethod field.
References
For more information
If you have any questions or comments about this advisory:
- Discuss in the existing issue
- Contact me
- Record
GHSA-p94w-42g3-f7h4- Updated
- 2026-11-02
OSVNo score
Holder can (re)create authentic credentials after receiving a credential in vp-toolkit
Impact
The verifyVerifiableCredential() method check the cryptographic integrity of the Verifiable Credential, but it does not check if the credential.issuer DID matches the signer of the credential.
The verifier is impacted by this vulnerability.
Patches
Patch will be available in version 0.2.2.
Workarounds
In case you trust certain issuers for certain credentials as a verifier, trust the issuer's public key from the credential.proof.verificationMethod field.
References
For more information
If you have any questions or comments about this advisory:
- Discuss in the existing issue
- Contact me
- Record
GHSA-p94w-42g3-f7h4- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.