8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40070

CVE-2026-40070: bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::WalletClient#acquire_certificate persists certificate records to storage without verifying the certifier's signature over the certificate contents. In acquisition_protocol: 'direct', the caller supplies all certificate fields (including signature:) and the record is written to storage verbatim. In acquisition_protocol: 'issuance', the client POSTs to a certifier URL and writes whatever signature the response body contains, also without verification. An attacker who can reach either API (or who controls a certifier endpoint targeted by the issuance path) can forge identity certificates that subsequently appear authentic to list_certificates and prove_certificate.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40070

CVE-2026-40070:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
bsv-sdk	rubygems	>= 0.3.1, < 0.8.2	0.8.2
bsv-wallet	rubygems	>= 0.1.2, < 0.3.4	0.3.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the bsv-sdk and bsv-wallet gems, specifically within the BSV::Wallet::WalletClient class in lib/bsv/wallet_interface/wallet_client.rb. The core issue is a failure to verify cryptographic signatures on identity certificates, as required by the BRC-52 specification. This allows an attacker to forge certificates.

The analysis of the patch commit 4992e8a265fd914a7eeb0405c69d1ff0122a84cc reveals the exact locations of the vulnerability. The two primary vulnerable functions are acquire_via_direct and acquire_via_issuance.

BSV::Wallet::WalletClient.acquire_via_direct: This function handles the 'direct' acquisition protocol, where a caller provides all certificate data. The vulnerability was that it accepted the signature field from the caller without any verification and passed it on for storage. An attacker could simply provide arbitrary bytes as a signature.
BSV::Wallet::WalletClient.acquire_via_issuance: This function handles the 'issuance' protocol, where the client communicates with a certifier's HTTP endpoint. The vulnerability was that it trusted the signature provided in the HTTP response from the endpoint without verification. This allows a malicious endpoint (or an attacker performing a MITM attack on an HTTP connection) to forge a certificate.

The parent function, BSV::Wallet::WalletClient.acquire_certificate, orchestrates this process. It calls one of the two vulnerable helper methods based on the acquisition_protocol and then writes the resulting certificate record to the wallet's storage. Therefore, during exploitation, all three functions would likely appear in a runtime profile's stack trace.

The patch introduces a new module, BSV::Wallet::CertificateSignature, which contains the logic to correctly verify BRC-52 certificate signatures. The fix involves adding calls to CertificateSignature.verify! within both acquire_via_direct and acquire_via_issuance before they return the certificate data, thus ensuring that no unverified certificate is ever persisted.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-40070: bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

CVE-2026-40070:

8.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Technical Details

Basic Information

Basic Information

8.1

8.1

CVE-2026-40070: bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

8.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-40070: bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

CVE-2026-40070:

8.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Basic Information

Basic Information

8.1

8.1

CVE-2026-40070: bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI