Impact The ""verifyVerifiableCredential()"" (https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-credential-signer.ts#L57) method check the cryptographic integrity of the Verifiable Credential, but it does not check if the ""credential.issuer"" (https://github.com/rabobank-blockchain/vp-toolkit-models/blob/develop/src/model/verifiable-credential.ts#L129) DID matches the signer of the credential. The verifier is impacted by this vulnerability. Patches Patch will be available in version 0.2.2. Workarounds In case you trust certain issuers for certain credentials as a verifier, trust the issuer's public key from the "credential.proof.verificationMethod" field. References "Github issue" (https://github.com/rabobank-blockchain/vp-toolkit/issues/13) For more information If you have any questions or comments about this advisory: * Discuss in the existing "issue" (https://github.com/rabobank-blockchain/vp-toolkit/issues/13) * "Contact me" (https://github.com/rabomarnix)