CVE-2020-11093: Hyperledger Indy's update process of a DID does not check who signs the request
Summary
CVE-2020-11093: Hyperledger Indy's update process of a DID does not check who signs the request. Affects indy-node versions < 1.12.4. Fixed in 1.12.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hyperledger Indy is an open-source distributed ledger technology (DLT) platform that provides tools and libraries for building decentralized identity systems. It allows users to create and manage decentralized identifiers (DIDs) and verifiable credentials. DIDs are unique identifiers that can be used to authenticate and authorize individuals or entities in a decentralized manner. The update process of a DID in Hyperledger Indy is vulnerable to a security issue that allows any DID to update another DID's alias without proper authorization.
Vulnerability Detail
The vulnerability in Hyperledger Indy's update process of a DID allows a malicious DID with no particular role to request an update for another DID, even if it does not have ownership or endorsement rights. This means that any DID can spam the ledger with unauthorized update transactions and change the alias of any other DID. The issue lies in the NymHandler method 'update_state' in the Indy codebase, where the ownership or endorsement of the requesting DID is not properly checked. This vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: 1.13.2 as of 23 Oct 2026
pip install --upgrade "indy-node==1.13.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.4
This is the first release that contains the fix.
pip install --upgrade "indy-node==1.12.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually review and validate the ownership or endorsement of the requesting DID before processing any update transactions. This can be done by inspecting the transaction details and verifying the signature of the requesting DID. However, it is strongly recommended to apply the official fix by upgrading to version 1.12.4 of the indy-node package.
Conclusion
The vulnerability in Hyperledger Indy's update process of a DID allows any DID to update another DID's alias without proper authorization. This can lead to unauthorized changes to the ledger metadata associated with DIDs. The issue has been fixed in version 1.12.4 of the indy-node package, and users are advised to upgrade to this version to mitigate the vulnerability.
See every vulnerability recorded for indy-node →
FAQ
Hyperledger Indy is an open-source distributed ledger technology (DLT) platform that provides tools and libraries for building decentralized identity systems.
A DID (Decentralized Identifier) is a unique identifier that can be used to authenticate and authorize individuals or entities in a decentralized manner.
This vulnerability allows any DID to update another DID's alias without proper authorization, leading to potential misuse and unauthorized changes to the ledger metadata associated with DIDs.
To fix this vulnerability, upgrade to version 1.12.4 of the indy-node package, which includes the necessary fix to properly check ownership or endorsement of the requesting DID.
As a temporary workaround, users can manually validate the ownership or endorsement of the requesting DID before processing update transactions. However, it is recommended to apply the official fix by upgrading to version 1.12.4 of the indy-node package.
References
Related vulnerabilities
Recent vulnerabilities recorded for indy-node.
