What is the CVSS score of EUVD-2026-20996?

EUVD-2026-20996 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-20996?

Within 24 hours: Inventory all systems and applications using BSV Ruby SDK versions 0.3.1-0.8.1 and assess whether certificate forgery could impact business-critical processes. Within 7 days: Disable the WalletClient#acquire_certificate method or restrict it to highly trusted internal sources only; implement additional signature validation outside the SDK. Within 30 days: Contact BSV maintainers to confirm patch timeline; if no patch is released, evaluate migration to alternative blockchain identity solutions or implement cryptographic validation at the application layer independent of the SDK.

Bsv Ruby Sdk EUVD-2026-20996

Q: Which versions of Bsv Ruby Sdk are affected by EUVD-2026-20996?

BSV Ruby SDK versions 0.3.1-0.8.1 contain a signature verification bypass that allows authenticated users to forge blockchain identity certificates, enabling account impersonation and fraudulent…. A patch is available.

| CVE-2026-40070 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-04-09 GitHub_M

GHSA-hc36-c89j-5f4j

Information Disclosure Jwt Attack Bsv Ruby Sdk Bsv Sdk Bsv Wallet

8.1

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to BSV Wallet API
Exploit

Submit certificate with forged signature via direct protocol
Execution

Write unverified certificate to storage
Impact

Use fraudulent certificate for blockchain transactions

Vulnerability Assessment

Weakness	CWE CWE-347 OWASP Top 10:2025 A04:2025 - Cryptographic Failures ASVS 5.0 V11 - Cryptography Signature verification
Exploitation Conditions	Authenticated user with network access to BSV Ruby SDK versions 0.3.1 to 0.8.1. Attacker must invoke BSV::Wallet::WalletClient#acquire_certificate method with either acquisition_protocol 'direct' (supplying forged certificate fields) or 'issuance' (controlling certifier URL or intercepting response).
Impact	Authenticated attackers can forge identity certificates in BSV Ruby SDK by bypassing signature verification in both direct and issuance protocols. CVSS 8.1 reflects high confidentiality and integrity impact. Real blast radius depends on SDK deployment scope; blockchain wallet applications using this SDK face authentication bypass and identity spoofing risks. Elevated observed exploitation activity signals active abuse.
Exploit ScenarioDerived	Authenticated attacker either (1) directly supplies forged certificate with fake signature via acquire_certificate API, or (2) controls certifier endpoint and responds with unsigned/invalid signature. Both paths write unverified records to storage, enabling subsequent authentication bypass via prove_certificate.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Signature verification bypass in BSV Ruby SDK versions 0.3.1 through 0.8.1 allows authenticated attackers to forge blockchain identity certificates. The WalletClient#acquire_certificate method persists certificates without validating certifier signatures in both 'direct' acquisition (where attackers supply all fields including forged signatures) and 'issuance' protocols (where malicious certifier endpoints inject invalid signatures). Forged certificates appear authentic to list_certificates and prove_certificate operations, enabling impersonation attacks. CVSS 8.1 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible exploitation requiring low-privilege authentication. No public exploit identified at time of analysis.

RemediationAI

Vendor-released patch: upgrade to BSV Ruby SDK version 0.8.2 or later, which implements cryptographic signature verification before certificate persistence. The fix is delivered via commit 4992e8a265fd914a7eeb0405c69d1ff0122a84cc merged in PR #306. Organizations unable to upgrade immediately should disable certificate acquisition APIs or implement external signature validation layers. Audit existing certificate stores for potentially forged records created between initial deployment and patch application. Official advisory and technical details: https://github.com/sgbett/bsv-ruby-sdk/security/advisories/GHSA-hc36-c89j-5f4j. Implementation reference: https://github.com/sgbett/bsv-ruby-sdk/pull/306. BSV certificate specification context: https://brc.dev/52.

Affected VersionsENISA

bsv-wallet 0.1.2, < 0.3.4

bsv-sdk 0.3.1, < 0.8.2

bsv-ruby-sdk 0.3.1, < 0.8.2

Affected Packages

rubygems bsv-sdk fix: 0.8.2

rubygems bsv-wallet fix: 0.3.4

euvd bsv_ruby_sdk_0_3_1 fix: 0.8.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in rubygems, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Root cause is improper certificate validation (CWE-347) in certificate acquisition logic. Direct protocol accepts caller-supplied signature fields without cryptographic verification; issuance protocol trusts remote certifier responses blindly. Missing signature validation occurs before storage persistence, allowing forged certificates to contaminate wallet state and subsequently pass authenticity checks in certificate listing/proving operations.

Know when Bsv Ruby Sdk gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 10, 2026 - 02:30 nvd

Patch available

CVE Published

Apr 09, 2026 - 17:26 nvd

HIGH 8.1

DescriptionCVE.org

BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to storage without verifying the certifier's signature over the certificate contents. In acquisition_protocol: 'direct', the caller supplies all certificate fields (including signature:) and the record is written to storage verbatim. In acquisition_protocol: 'issuance', the client POSTs to a certifier URL and writes whatever signature the response body contains, also without verification. An attacker who can reach either API (or who controls a certifier endpoint targeted by the issuance path) can forge identity certificates that subsequently appear authentic to list_certificates and prove_certificate.

Executive ViewAI

Why It Matters

BSV Ruby SDK versions 0.3.1-0.8.1 contain a signature verification bypass that allows authenticated users to forge blockchain identity certificates, enabling account impersonation and fraudulent identity claims. Organizations using this SDK for certificate-based authentication face direct risk to identity integrity and access control, particularly if the SDK is deployed in production systems handling financial transactions or sensitive access decisions.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to certificate acquisition endpoints to trusted internal systems only; (2) Implement independent ECDSA signature verification of all certificates before accepting them for identity decisions, outside the SDK; (3) Deploy certificate pinning and require manual approval workflows for any new certificate acquisition; (4) Audit all certificates issued in the past 90 days for signs of forgery, particularly those with unusual issuers or timestamps.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Threat Intel

1 source

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.