GHSA-p94w-42g3-f7h4
Holder can (re)create authentic credentials after receiving a credential in vp-toolkit
Quick fix
GHSA-p94w-42g3-f7h4 — vp-toolkit: upgrade to the fixed version with the command below.
npm install vp-toolkit@0.2.2Details
### Impact The [`verifyVerifiableCredential()`](https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-credential-signer.ts#L57) method check the cryptographic integrity of the Verifiable Credential, but it does not check if the [`credential.issuer`](https://github.com/rabobank-blockchain/vp-toolkit-models/blob/develop/src/model/verifiable-credential.ts#L129) DID matches the signer of the credential.
The **verifier** is impacted by this vulnerability.
### Patches Patch will be available in version 0.2.2.
### Workarounds In case you trust certain issuers for certain credentials as a verifier, trust the issuer's public key from the `credential.proof.verificationMethod` field.
### References [Github issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/13)
### For more information If you have any questions or comments about this advisory: * Discuss in the existing [issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/13) * [Contact me](https://github.com/rabomarnix)
Are you affected?
Enter the version of the package you're using.