CVE-2024-21669

Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.

• CWE-347

• https://github.com/hyperledger/aries-cloudagent-python/commit/0b01ffffc0789205ac990292f97238614c9fd293Patch
• https://github.com/hyperledger/aries-cloudagent-python/commit/4c45244e2085aeff2f038dd771710e92d7682ff2Patch
• https://github.com/hyperledger/aries-cloudagent-python/releases/tag/0.10.5Release Notes
• https://github.com/hyperledger/aries-cloudagent-python/releases/tag/0.11.0Release Notes
• https://github.com/hyperledger/aries-cloudagent-python/security/advisories/GHSA-97x9-59rv-q5pmExploit, Vendor Advisory
• https://github.com/hyperledger/aries-cloudagent-python/commit/0b01ffffc0789205ac990292f97238614c9fd293Patch
• https://github.com/hyperledger/aries-cloudagent-python/commit/4c45244e2085aeff2f038dd771710e92d7682ff2Patch
• https://github.com/hyperledger/aries-cloudagent-python/releases/tag/0.10.5Release Notes
• https://github.com/hyperledger/aries-cloudagent-python/releases/tag/0.11.0Release Notes
• https://github.com/hyperledger/aries-cloudagent-python/security/advisories/GHSA-97x9-59rv-q5pmExploit, Vendor Advisory

Published

Jan 11, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21663Discord-Recon is a Discord bot created to automate bug bount…8.8
• CVE-2024-21664jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS…7.5
• CVE-2024-21665ecommerce-framework-bundle is the Pimcore Ecommerce Framewor…4.3
• CVE-2024-21666The Customer Management Framework (CMF) for Pimcore adds fun…6.5
• CVE-2024-21667pimcore/customer-data-framework is the Customer Management F…6.5
• CVE-2024-21668react-native-mmkv is a library that allows easy use of MMKV …4.9
• CVE-2024-2167Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-21670Ursa is a cryptographic library for use with blockchains. Th…8.1
• CVE-2024-21671The vantage6 technology enables to manage and deploy privacy…3.7
• CVE-2024-21672This High severity Remote Code Execution (RCE) vulnerability…8.8
• CVE-2024-21673This High severity Remote Code Execution (RCE) vulnerability…8.8
• CVE-2024-21674This High severity Remote Code Execution (RCE) vulnerability…7.5