Overview

The SD JWT JS vulnerability, tracked as CVE-2026-62374, affects the `@sd-jwt/decode` library. This library is used for decoding SD-JWT (Selective Disclosure JSON Web Tokens) presentations. The vulnerability allows an attacker to tamper with disclosures in an SD-JWT presentation, causing the library to silently drop the tampered disclosure instead of rejecting the entire presentation. This results in a reduced claim set being returned, potentially leading to authorization bypass or downgrade attacks.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this vulnerability lies in the way the `@sd-jwt/decode` library handles disclosures in an SD-JWT presentation. Specifically, the library fails to properly enforce the requirements outlined in RFC 9901, section 7.1, step 5, and section 4.2.1. These requirements dictate that if a disclosure is not referenced by digest value in the issuer-signed JWT or if a disclosure fails base64url/JSON decoding, the SD-JWT must be rejected.

Instead of rejecting the presentation, the library lossy-decodes non-base64url-JSON disclosures and silently skips disclosures with digests not present in the signed `_sd` array. This behavior enables an attacker to manipulate disclosures, leading to a reduced claim set being presented to the relying party.

Attack Surface & Vector

The attack surface for this vulnerability includes any application or system that uses the `@sd-jwt/decode` library to process SD-JWT presentations. The attack vector involves an attacker tampering with one or more disclosures in an SD-JWT presentation, which can be done in-transit if the relying party does not enforce key binding or by a malicious holder with access to the SD-JWT presentation.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Corporate SD-JWT Instance

Initial Position: An attacker gains access to an SD-JWT presentation, either by intercepting it in-transit or by obtaining it from a malicious holder.

Triggering the Flaw: The attacker tampers with a disclosure in the SD-JWT presentation, making it non-decodable or altering its digest so that it no longer matches the issuer-signed `_sd` array.

What Breaks: The `@sd-jwt/decode` library fails to reject the tampered SD-JWT presentation. Instead, it lossy-decodes the tampered disclosure (if applicable) and silently skips it because its digest is not in the signed `_sd` array.

Attacker's Prize: The attacker achieves a reduced claim set being presented to the relying party. If the relying party's authorization logic defaults to allowing access when a constraining claim is absent, the attacker can bypass authorization or downgrade the access level.

Real-World Impact

The impact of this vulnerability is significant, as it can lead to authorization bypass or downgrade attacks. An attacker can exploit this vulnerability to gain unauthorized access to sensitive resources or to reduce the access level of a legitimate user. The vulnerability affects wallet/verifier deployments built on `@sd-jwt/*`, particularly those using SD-JWT VC and the EU EUDIW ARF profiles.

Detection & Defense

Immediate Mitigations

To mitigate this vulnerability, users of the `@sd-jwt/decode` library should upgrade to version 0.19.1 or later, which includes the fix for CVE-2026-62374.

Detection Strategies

Defenders can detect exploitation attempts by monitoring for unusual patterns in SD-JWT presentations, such as disclosures with invalid digests or non-base64url-JSON encoded disclosures. Implementing strict validation of SD-JWT presentations according to RFC 9901 can also help detect and prevent exploitation.

Long-Term Hardening

To prevent similar vulnerabilities in the future, it is recommended to implement defense-in-depth strategies, such as:

  • Enforcing strict validation of SD-JWT presentations according to RFC 9901.
  • Implementing key binding to prevent tampering with SD-JWT presentations in-transit.
  • Regularly updating and patching dependencies, including the `@sd-jwt/decode` library.

Key Takeaways

  • The SD JWT JS vulnerability (CVE-2026-62374) allows tampered disclosures to be silently dropped, leading to reduced claim sets and potential authorization bypass.
  • The vulnerability is caused by the library's failure to properly enforce RFC 9901 requirements.
  • Immediate mitigation involves upgrading to version 0.19.1 or later of the `@sd-jwt/decode` library.
  • Detection and defense strategies include monitoring for unusual SD-JWT presentation patterns and implementing strict validation and key binding.

Sources