The vulnerability allows unverified certifier signatures to be stored during the certificate acquisition process, whether through the direct or issuance protocol. Because the client writes the signature it receives directly to storage, an attacker can supply or forge a certifier signature that will subsequently appear valid to list_certificates and prove_certificate calls. This flaw permits the creation of false identity certificates that an application will treat as legitimate, potentially enabling impersonation or unauthorized operations on the BSV network. The weakness is a classic example of improper validation of user data (CWE-347).

The issue affects the sgbett BSV Ruby SDK, BSV SDK, and BSV Wallet products. Version numbers from 0.3.1 up to, but not including, 0.8.2 are vulnerable. Systems running these libraries that expose the acquire_certificate API are exposed to risk, especially those that permit external callers to request certificates or control a certifier endpoint.

The CVSS score of 8.1 indicates a high severity vulnerability. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, but the attack vector is straightforward: an attacker can send a crafted request to either the direct or issuance acquire_certificate endpoint, or control a certifier endpoint and supply a forged signature. The exploit has minimal prerequisites—simply the ability to communicate with the API—and therefore the likelihood of exploitation is high. The resulting impact ranges from identity spoofing to potentially fraudulent transactions if certificate-based authorization is used.