Read the docs
TI-2020-08966 Aliases CVE-2020-11093GHSA-wh2w-39f4-rpv2

Authorization bypass in Hyperledger Indy

Priority LOW 35CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

Hyperledger Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In Hyperledger Indy before version 1.12.4, there is lack of signature verification on a specific transaction which enables an attacker to make certain unauthorized alterations to the ledger. Updating a DID with a nym transaction will be written to the ledger if neither ROLE or VERKEY are being changed, regardless of sender. A malicious DID with no particular role can ask an update for another DID (but cannot modify its verkey or role). This is bad because 1) Any DID can write a nym transaction to the ledger (i.e., any DID can spam the ledger with nym transactions), 2) Any DID can change any other DID's alias, 3) The update transaction modifies the ledger metadata associated with a DID.

Why it matters now

EPSS 0.01183 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed indy-node (hyperledger): 1.12.4indy-node (PyPI): 1.12.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
hyperledgerindy-nodebefore 1.12.41.12.4Patch availableCNA
—indy-node (PyPI)before 1.12.41.12.4Patch availableGHSA-wh2w-39f4-rpv2
  • indy-node Vendorhyperledger Affected before 1.12.4 Fixed in 1.12.4 Patch available CNA
  • indy-node (PyPI) Vendor— Affected before 1.12.4 Fixed in 1.12.4 Patch available GHSA-wh2w-39f4-rpv2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:indy-node:*:*:*:*:*:*:*:*before 1.12.4Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:indy-node:*:*:*:*:*:*:*:* Versions before 1.12.4 Vulnerable ·backstage

Remediation

  • Fix · CNA indy-node (hyperledger) Fixed in 1.12.4
  • Fix · GHSA-wh2w-39f4-rpv2 indy-node (PyPI) Fixed in 1.12.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11093
  2. 2026-10-03 Alias added: GHSA-wh2w-39f4-rpv2

References

Exploit 1

Patch 1

Advisory 3

Other 2

  • TI-2026-30139 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE CVSS 4.0CRITICAL 9.3
  • TI-2024-14390 Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC CVSS 3.1CRITICAL 9.9
  • TI-2022-13066 Unlinkability broken in ursa when verifiers use malicious keys CVSS 3.1MEDIUM 5.3
  • TI-2022-16450 Incorrect Conversion between Numeric Types in Besu Ethereum Client CVSS 3.1CRITICAL 9.1
  • TI-2022-13065 Remote code execution in Indy's NODE_UPGRADE transaction CVSS 3.1HIGH 8.8
  • TI-2025-21486 ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve CVSS 4.0HIGH 8.7
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences