Read the docs
TI-2026-28901 Aliases CVE-2026-40070GHSA-hc36-c89j-5f4j

bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

Priority HIGH 70CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to storage without verifying the certifier's signature over the certificate contents. In acquisition_protocol: 'direct', the caller supplies all certificate fields (including signature:) and the record is written to storage verbatim. In acquisition_protocol: 'issuance', the client POSTs to a certifier URL and writes whatever signature the response body contains, also without verification. An attacker who can reach either API (or who controls a certifier endpoint targeted by the issuance path) can forge identity certificates that subsequently appear authentic to list_certificates and prove_certificate.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00138 3rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed bsv-ruby-sdk (sgbett): 0.8.2bsv-sdk (sgbett): 0.8.2+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sgbettbsv-ruby-sdk0.3.1 to before 0.8.20.8.2Patch availableCNA
sgbettbsv-sdk0.3.1 to before 0.8.20.8.2Patch availableCNA
sgbettbsv-wallet0.1.2 to before 0.3.40.3.4Patch availableCNA
—bsv-sdk (RubyGems)0.3.1 to before 0.8.20.8.2Patch availableGHSA-hc36-c89j-5f4j
—bsv-wallet (RubyGems)0.1.2 to before 0.3.40.3.4Patch availableGHSA-hc36-c89j-5f4j
  • bsv-ruby-sdk Vendorsgbett Affected 0.3.1 to before 0.8.2 Fixed in 0.8.2 Patch available CNA
  • bsv-sdk Vendorsgbett Affected 0.3.1 to before 0.8.2 Fixed in 0.8.2 Patch available CNA
  • bsv-wallet Vendorsgbett Affected 0.1.2 to before 0.3.4 Fixed in 0.3.4 Patch available CNA
  • bsv-sdk (RubyGems) Vendor— Affected 0.3.1 to before 0.8.2 Fixed in 0.8.2 Patch available GHSA-hc36-c89j-5f4j
  • bsv-wallet (RubyGems) Vendor— Affected 0.1.2 to before 0.3.4 Fixed in 0.3.4 Patch available GHSA-hc36-c89j-5f4j

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:sgbett:bsv-wallet:*:*:*:*:*:ruby:*:*0.1.2 to before 0.3.4Vulnerablesgbett
cpe:2.3:a:sgbett:bsv_ruby_sdk:*:*:*:*:*:ruby:*:*0.3.1 to before 0.8.2Vulnerablesgbett
  • cpe:2.3:a:sgbett:bsv-wallet:*:*:*:*:*:ruby:*:* Versions 0.1.2 to before 0.3.4 Vulnerable ·sgbett
  • cpe:2.3:a:sgbett:bsv_ruby_sdk:*:*:*:*:*:ruby:*:* Versions 0.3.1 to before 0.8.2 Vulnerable ·sgbett

Remediation

  • Fix · CNA bsv-ruby-sdk (sgbett) Fixed in 0.8.2
  • Fix · CNA bsv-sdk (sgbett) Fixed in 0.8.2
  • Fix · CNA bsv-wallet (sgbett) Fixed in 0.3.4
  • Fix · GHSA-hc36-c89j-5f4j bsv-sdk (RubyGems) Fixed in 0.8.2 Advisory →
  • Fix · GHSA-hc36-c89j-5f4j bsv-wallet (RubyGems) Fixed in 0.3.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40070
  2. 2026-10-03 Alias added: GHSA-hc36-c89j-5f4j

References

Exploit 1

Advisory 1

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences