The bsv-rs crate contains a vulnerability in the function KVStoreInterpreter::verify_signature_legacy, which always returns true regardless of the token or key provided. This flaw existed in all versions prior to 0.8.9 and certain prereleases of 0.9.0-beta, allowing acceptance of unsigned or improperly signed tokens. The issue was fixed in versions 0.8.9 and 0.9.0-beta.7.0. Applications relying on this function to verify KVStore tokens they did not create may incorrectly accept unauthorized data.