GHSA-ff5x-w9wg-h275 Holder can generate proof of ownership for credentials it does not control in vp-toolkit

• npm vp-toolkit: < 0.2.2 → fixed in 0.2.2

Impact The `verifyVerifiablePresentation()` method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the `credentialSubject.id` DID matches the signer of the VP proof. The verifier is impacted by this vulnerability. Patches Patch will be available in version 0.2.2. Workarounds • Compute the address out of the `verifiablePresentation.proof.n.verificationMethod` using `getAddressFromPubKey()` from `[email protected]` and match it with the `credentialSubject.id` address from the credential. References Github issue For more information If you have any questions or comments about this advisory: • Discuss in the existing issue • Contact me