Verification flaw in Solid identity-token-verifier
Summary
GHSA-xmh9-rg6f-j3mr: Verification flaw in Solid identity-token-verifier. Affects @solid/identity-token-verifier versions < 0.5.2. Fixed in 0.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Solid identity-token-verifier library is an implementation used by Pods on a Solid server to verify Demonstration of Proof-of-Possession (DPoP) token bindings. DPoP proofs are used to bind access tokens to a private key that should be in the sole possession of a specific user. This library is responsible for verifying the DPoP proofs against the hash of an embedded public key. However, a verification flaw in the implementation allows DPoP proofs to be spoofed, potentially giving an attacker total access to a targeted Pod.
Vulnerability Detail
The verification flaw in the identity-token-verifier library allows an attacker in possession of a targeted access token to build an attack environment and replay the token on any Pod service with this vulnerability. By spoofing another user's DPoP, the attacker can rebind the DPoP-bound access token and gain complete access to the targeted Pod. This vulnerability poses a significant risk to the security and integrity of the affected Pods.
How To Fix
Latest published version: 0.8.0 as of 22 Oct 2026
npm install @solid/identity-token-verifier@0.8.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.2
This is the first release that contains the fix.
npm install @solid/identity-token-verifier@0.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The verification flaw in the Solid identity-token-verifier library poses a significant security risk to Pods on Solid servers. By spoofing DPoP proofs, an attacker can gain complete access to a targeted Pod, compromising its data and security. It is crucial to update the library to version 0.5.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @solid/identity-token-verifier →
FAQ
Any Pod on a Solid server using a vulnerable version of the identity-token-verifier library is at risk of a spoofed DPoP token binding. This could give an attacker total and complete access to the targeted Pod.
The library verifies DPoP proofs against a field that an attacker can modify to spoof another user's DPoP. Instead of verifying against the hash of an embedded public key, the library checks a different field, allowing the attacker to manipulate it and spoof the DPoP.
With a stolen DPoP proof, an attacker can rebind a DPoP-bound access token and gain complete access to the targeted Pod. This allows the attacker to perform any actions and potentially compromise the data and security of the Pod.
To fix this vulnerability, you should update the identity-token-verifier library to version 0.5.2 or later. This update includes the necessary fix to prevent DPoP proofs from being spoofed.
No, there are no known workarounds for this vulnerability. It is recommended to update the library to the fixed version as soon as possible.
