CVE-2026-40070: bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-09 · updated 2026-10-26
Weakness: CWE-347

Description

BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to storage without verifying the certifier's signature over the certificate contents. In acquisition_protocol: 'direct', the caller supplies all certificate fields (including signature:) and the record is written to storage verbatim. In acquisition_protocol: 'issuance', the client POSTs to a certifier URL and writes whatever signature the response body contains, also without verification. An attacker who can reach either API (or who controls a certifier endpoint targeted by the issuance path) can forge identity certificates that subsequently appear authentic to list_certificates and prove_certificate.

Affected products

sgbett bsv-wallet: from 0.1.2 before 0.3.4 — fixed in 0.3.4
sgbett bsv-ruby-sdk: from 0.3.1 before 0.8.2 — fixed in 0.8.2

How to fix

Upgrade to a fixed version: sgbett bsv-wallet 0.3.4; sgbett bsv-ruby-sdk 0.8.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-40070 or the next vulnerability affects your stack