SD-JWT verifiers that accept unreferenced disclosures (RFC 9901, Section 7.1, step 5): disclosure note, 27 October 2026

Step 5 of the verification procedure in RFC 9901, Section 7.1, requires a verifier to reject a Selective Disclosure JSON Web Token (SD-JWT) presentation when one of its disclosures is not referenced by any digest in the issuer-signed payload. A verifier that omits the check accepts a presentation whose disclosure has been altered, and returns the claim set with that claim silently missing instead of rejecting it. This note names the SD-JWT verifier releases in which we found the omission and that we reported privately on 4 August 2026. It records each maintainer's status on 27 October 2026, the day of publication, six days before the 90-day disclosure window was due to end on 2 November 2026.