CVE-2026-62374 affects the @sd-jwt/core JavaScript library used for Selective Disclosure JWT (SD-JWT) implementations. Versions 0.19.0 and earlier of @sd-jwt/core and @sd-jwt/decode silently drop tampered or malformed Disclosures without error, returning a reduced claim set while still reporting verification success. This behavior violates RFC 9901 requirements to reject unreferenced or invalid Disclosures. An attacker can exploit this to alter authorization decisions if key binding is not enforced, potentially bypassing claim-based restrictions. The issue is fixed in version 0.20.0 of @sd-jwt/core. No patch is identified for the standalone @sd-jwt/decode package.