GHSA-p94w-42g3-f7h4 Holder can (re)create authentic credentials after receiving a credential in vp-toolkit

• npm vp-toolkit: < 0.2.2 → fixed in 0.2.2

Impact The `verifyVerifiableCredential()` method check the cryptographic integrity of the Verifiable Credential, but it does not check if the `credential.issuer` DID matches the signer of the credential. The verifier is impacted by this vulnerability. Patches Patch will be available in version 0.2.2. Workarounds In case you trust certain issuers for certain credentials as a verifier, trust the issuer&#39;s public key from the `credential.proof.verificationMethod` field. References Github issue For more information If you have any questions or comments about this advisory: • Discuss in the existing issue • Contact me