{"id":"CVE-2026-40070","aliases":["GHSA-hc36-c89j-5f4j"],"url":"https://o3.security/vulnerability/CVE-2026-40070","summary":"bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)","details":"BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to storage without verifying the certifier's signature over the certificate contents. In acquisition_protocol: 'direct', the caller supplies all certificate fields (including signature:) and the record is written to storage verbatim. In acquisition_protocol: 'issuance', the client POSTs to a certifier URL and writes whatever signature the response body contains, also without verification. An attacker who can reach either API (or who controls a certifier endpoint targeted by the issuance path) can forge identity certificates that subsequently appear authentic to list_certificates and prove_certificate.","published":"2026-04-09T17:26:51.495Z","modified":"2026-07-15T01:49:03.016167498Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"bsv-sdk","fixedVersion":"0.8.2"},{"ecosystem":"RubyGems","name":"bsv-wallet","fixedVersion":"0.3.4"}],"fix":{"url":"https://github.com/sgbett/bsv-ruby-sdk/commit/4992e8a265fd914a7eeb0405c69d1ff0122a84cc","label":"sgbett/bsv-ruby-sdk@4992e8a"},"references":[{"type":"WEB","url":"https://brc.dev/52"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40070.json"},{"type":"ADVISORY","url":"https://github.com/sgbett/bsv-ruby-sdk/security/advisories/GHSA-hc36-c89j-5f4j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40070"},{"type":"REPORT","url":"https://github.com/sgbett/bsv-ruby-sdk/issues/305"},{"type":"FIX","url":"https://github.com/sgbett/bsv-ruby-sdk/commit/4992e8a265fd914a7eeb0405c69d1ff0122a84cc"},{"type":"FIX","url":"https://github.com/sgbett/bsv-ruby-sdk/pull/306"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:49:03.016167498Z"}}