Threats tagged 'ghsa-f9j6-8p6x-r9j6'

A vulnerability in @sd-jwt/decode version 0.19.0 and earlier allows tampered disclosures in SD-JWT presentations to be silently dropped instead of causing rejection. This leads to a reduced claim set being accepted without error, enabling a malicious holder or an on-path attacker to omit claims without detection. The issue violates RFC 9901 requirements for disclosure validation and can cause relying parties to make incorrect authorization decisions if they default to allow when claims are missing.