CVE-2026-40070 describes a vulnerability in the sgbett bsv-ruby-sdk where the WalletClient#acquire_certificate method does not verify the certifier's signature on certificate contents before storing them. In the 'direct' acquisition protocol, all certificate fields including the signature are accepted from the caller and stored verbatim. In the 'issuance' protocol, the client sends a POST request to a certifier URL and stores the signature from the response without verification. This flaw allows an attacker with access to either API or control over a certifier endpoint to forge identity certificates that are accepted as valid by subsequent SDK operations such as list_certificates and prove_certificate.

An attacker able to reach the affected APIs or control a certifier endpoint can create forged identity certificates that the SDK treats as authentic. This compromises the integrity of identity verification within the BSV Ruby SDK, potentially allowing unauthorized identities to be accepted as valid. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS score of 8.1 reflects high impact on confidentiality and integrity with low attack complexity and no user interaction required.

Patch status is not yet confirmed — no official fix or patch links are provided. Users of the affected versions (>=0.3.1 and <0.8.2) should monitor the vendor's advisory channels for updates. Until a fix is available, avoid using the vulnerable acquire_certificate functionality or restrict access to the relevant APIs and certifier endpoints to trusted parties only to reduce risk.