CVE-2026-40070: bsv-sdk and bsv-wallet Unverified Certifier Signatures Vulnerability
Summary
CVE-2026-40070: Unverified certifier signatures persisted by acquire_certificate Affected packages Both bsv-sdk and bsv-wallet are published from the sgbett/bsv-ruby-sdk repository. Affects bsv-sdk versions >= 0.3.1, < 0.8.2. Fixed in 0.8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bsv-sdk and bsv-wallet are Ruby libraries designed for interacting with the Bitcoin SV blockchain, providing functionalities such as wallet management and certificate handling. These packages are crucial for developers building applications that require secure identity verification and transaction processing on the blockchain. However, both libraries have a significant vulnerability that allows unverified certifier signatures to be persisted, potentially leading to credential forgery.
Vulnerability Detail
The vulnerability arises from the acquire_certificate method in both bsv-sdk and bsv-wallet, which allows certificate records to be stored without verifying the certifier's signature. This issue affects both direct and issuance acquisition paths. An attacker can exploit this vulnerability by supplying arbitrary signature values, leading to the storage of forged certificates that appear authentic. The lack of signature verification means that any caller with access to the acquire_certificate method can create fraudulent certificates, undermining the integrity of identity verification processes.
How To Fix
Minimum fixed version
0.8.2
This is the first release that contains the fix.
gem install bsv-sdk -v 0.8.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider the following workarounds:
- Do not expose the
acquire_certificatemethod to untrusted callers. - Avoid using the
acquire_certificatemethod with theacquisition_protocol: 'issuance'against untrusted certifier URLs, and ensure TLS is used for such requests. - Treat any records returned by
list_certificatesorprove_certificateas unverified and perform an out-of-band verification against the certifier's public key.
Conclusion
In summary, CVE-2026-40070 is a critical vulnerability in the bsv-sdk and bsv-wallet packages that allows for the persistence of unverified certifier signatures, leading to potential credential forgery. It is essential to upgrade to the patched versions to mitigate this risk and ensure the integrity of identity verification processes.
See every vulnerability recorded for bsv-sdk →
FAQ
CVE-2026-40070 is a vulnerability in the bsv-sdk and bsv-wallet packages that allows unverified certifier signatures to be persisted, leading to potential credential forgery.
If your application relies on the bsv-sdk or bsv-wallet for identity verification, this vulnerability could allow attackers to create and store forged certificates, compromising the integrity of user identities.
The affected versions of bsv-sdk are >= 0.3.1 and < 0.8.2, and for bsv-wallet, they are >= 0.1.2 and < 0.3.4.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. You can use the Vulert playground without signup to analyze your application.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for bsv-sdk.
