What is the CVSS score of CVE-2026-40070?

CVE-2026-40070 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Jwt Attack are affected by CVE-2026-40070?

BSV Ruby SDK versions 0.3.1-0.8.1 contain a signature verification bypass that allows authenticated users to forge blockchain identity certificates, enabling account impersonation and fraudulent…. A patch is available.

How to fix or mitigate CVE-2026-40070?

Within 24 hours: Inventory all systems and applications using BSV Ruby SDK versions 0.3.1-0.8.1 and assess whether certificate forgery could impact business-critical processes. Within 7 days: Disable the WalletClient#acquire_certificate method or restrict it to highly trusted internal sources only; implement additional signature validation outside the SDK. Within 30 days: Contact BSV maintainers to confirm patch timeline; if no patch is released, evaluate migration to alternative blockchain identity solutions or implement cryptographic validation at the application layer independent of the SDK.

Jwt Attack CVE-2026-40070

EUVD-2026-20996 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-04-09 GitHub_M

GHSA-hc36-c89j-5f4j

Information Disclosure Jwt Attack

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 17:07 vuln.today

cvss_changed

Patch released

Apr 10, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 18:15 euvd

EUVD-2026-20996

Analysis Generated

Apr 09, 2026 - 18:15 vuln.today

CVE Published

Apr 09, 2026 - 17:26 nvd

HIGH 8.1

DescriptionGitHub Advisory

BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to storage without verifying the certifier's signature over the certificate contents. In acquisition_protocol: 'direct', the caller supplies all certificate fields (including signature:) and the record is written to storage verbatim. In acquisition_protocol: 'issuance', the client POSTs to a certifier URL and writes whatever signature the response body contains, also without verification. An attacker who can reach either API (or who controls a certifier endpoint targeted by the issuance path) can forge identity certificates that subsequently appear authentic to list_certificates and prove_certificate.

AnalysisAI

Signature verification bypass in BSV Ruby SDK versions 0.3.1 through 0.8.1 allows authenticated attackers to forge blockchain identity certificates. The WalletClient#acquire_certificate method persists certificates without validating certifier signatures in both 'direct' acquisition (where attackers supply all fields including forged signatures) and 'issuance' protocols (where malicious certifier endpoints inject invalid signatures). Forged certificates appear authentic to list_certificates and prove_certificate operations, enabling impersonation attacks. CVSS 8.1 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible exploitation requiring low-privilege authentication. No public exploit identified at time of analysis.

Technical ContextAI

Root cause is improper certificate validation (CWE-347) in certificate acquisition logic. Direct protocol accepts caller-supplied signature fields without cryptographic verification; issuance protocol trusts remote certifier responses blindly. Missing signature validation occurs before storage persistence, allowing forged certificates to contaminate wallet state and subsequently pass authenticity checks in certificate listing/proving operations.

RemediationAI

Vendor-released patch: upgrade to BSV Ruby SDK version 0.8.2 or later, which implements cryptographic signature verification before certificate persistence. The fix is delivered via commit 4992e8a265fd914a7eeb0405c69d1ff0122a84cc merged in PR #306. Organizations unable to upgrade immediately should disable certificate acquisition APIs or implement external signature validation layers. Audit existing certificate stores for potentially forged records created between initial deployment and patch application. Official advisory and technical details: https://github.com/sgbett/bsv-ruby-sdk/security/advisories/GHSA-hc36-c89j-5f4j. Implementation reference: https://github.com/sgbett/bsv-ruby-sdk/pull/306. BSV certificate specification context: https://brc.dev/52.