VC Authorization Bypass

Status: Released
Published: 31.07.2026
Effective: 31.07.2026
Affected Components: Generic Verifier
Internal Reference: EIDSEC-890, EIDOMNI-1171

The VC signature verification uses the kid header to resolve the signing key, but trust validation used the iss claim without comparing the two. This allows an attacker to present a credential signed by their own key (kid=attacker) while claiming a trusted issuer iss=trusted), bypassing trust validation.

Action required

⚠️ Required soon 🚨 Breaking 🆕 Optional ✅ Improvement 🐞 Fix

Generic Verifier

Version: 4.1.2
⚠️ Critical Vulnerability, upgrade ASAP

  • Version 4.1.2 contains the fix (branch: feature/EIDOMNI-1171_rework_did_resolution), upgrade to this version
  • The fix binds trust validation to the DID from the kid header (actual signer), not the iss claim

Migration steps

  • Since there are no breaking changes associated with the fix, there are no specific migration steps necessary.

Timeline

  • 27 July 2026: Vulnerability reported through the BugBounty Program
  • 29 July 2026: Vulnerability announced, fix available on feature branch
  • 30 July 2026: Version 4.1.2 released with fix

Root Cause (EIDOMNI-873)

Commit Date Change
a870ddd2 2026-07-08 Removed iss claim from DidJwtValidator.getDidString() — DID resolution now uses only kid header
a4d7dde5 2026-07-08 Removed kid vs iss equality check in SdJwtVpTokenVerifier.verifyVpTokenTrustStatement()

Affected Versions

Version Status Notes
4.1.0 🚨 Vulnerable First release with EIDOMNI-873 changes
4.1.1 🚨 Vulnerable Current main branch
4.1.2 ✅ Fixed Branch feature/EIDOMNI-1171_rework_did_resolution

Fix Commits

Commit Issue Change
da633dcd EIDOMNI-1171 DCQL flow: trust validated against kid DID via DidKidParser
bcf4bca2 EIDOMNI-1050 Trust Protocol 1.0: explicit kid DID == iss check restored