Vulnerability in vp-toolkit: Holder can (re)create authentic credentials
Summary
GHSA-p94w-42g3-f7h4: Holder can (re)create authentic credentials after receiving a credential in vp-toolkit. Affects vp-toolkit versions < 0.2.2. Fixed in 0.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vp-toolkit is an npm package that provides a toolkit for working with verifiable credentials. It includes functionality for verifying the cryptographic integrity of Verifiable Credentials. However, a vulnerability has been identified in the verifyVerifiableCredential() method, which does not check if the issuer DID matches the signer of the credential. This vulnerability affects the verifier.
Vulnerability Detail
The verifyVerifiableCredential() method in vp-toolkit does not properly validate the issuer of a Verifiable Credential. This means that an attacker can create or recreate authentic credentials with a different issuer DID. This could lead to the acceptance of fraudulent credentials by the verifier, compromising the integrity of the system. The vulnerability has a high severity rating.
How To Fix
Latest published version: 0.2.3 as of 23 Oct 2026
npm install vp-toolkit@0.2.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.2
This is the first release that contains the fix.
npm install vp-toolkit@0.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you trust certain issuers for certain credentials as a verifier, you can trust the issuer's public key from the credential.proof.verificationMethod field. This can provide an additional layer of verification until the package is updated.
Conclusion
The vulnerability in vp-toolkit allows an attacker to create or recreate authentic credentials with a different issuer DID, potentially leading to the acceptance of fraudulent credentials. It is recommended to update the package to version 0.2.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for vp-toolkit →
FAQ
vp-toolkit is an npm package that provides a toolkit for working with verifiable credentials. It includes functionality for verifying the cryptographic integrity of Verifiable Credentials.
The vulnerability allows an attacker to create or recreate authentic credentials with a different issuer DID, potentially leading to the acceptance of fraudulent credentials by the verifier.
To fix this vulnerability, update the vp-toolkit package to version 0.2.2 or later.
If you trust certain issuers for certain credentials, you can trust the issuer's public key from the credential.proof.verificationMethod field as an additional verification step.
You can find more information about this vulnerability in the GitHub issue: https://github.com/rabobank-blockchain/vp-toolkit/issues/13
References
Related vulnerabilities
Recent vulnerabilities recorded for vp-toolkit.
