CVE-2026-40070 - Vulnerability Analysis

Overview

BSV Ruby SDK 0.3.1 to < 0.8.2 contains a broken authentication caused by lack of signature verification in certificate acquisition, letting attackers forge identity certificates, exploit requires access to certificate APIs or control of certifier endpoint.

Severity & Score

Impact

Attackers can forge identity certificates, leading to impersonation and unauthorized access within the system.

Mitigation

Upgrade to version 0.8.2 or later.

References

• https://github.com/sgbett/bsv-ruby-sdk/pull/306
• https://github.com/sgbett/bsv-ruby-sdk/security/advisories/GHSA-hc36-c89j-5f4j
• https://brc.dev/52
• https://github.com/sgbett/bsv-ruby-sdk/commit/4992e8a265fd914a7eeb0405c69d1ff0122a84cc
• https://github.com/sgbett/bsv-ruby-sdk/issues/305

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner