Metadata not used when credential_issuer mismatches the identifier

OID4VCI 1.0 §12.2.4MUST NOTRoles: wallet

Requirement as recorded in the ProtocolSoup registry

If the credential_issuer value in metadata does not match the Credential Issuer Identifier used to retrieve it (simple string comparison, no normalization), the metadata MUST NOT be used.

Read §12.2.4 in OID4VCI 1.0

Self-test verdict

PassCommit 97df6a8Evaluated 2026-10-11

This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.

Tests

TestMetadataCredentialIssuerMismatchRejection
./cmd/walletharness
Pass

Implementation

backend/cmd/walletharness/oid4vci_external.go
backend/cmd/walletharness/oid4vci_client.go

Related requirements

Also in §12.2.4

CI-018mso_mdoc signing algorithms as numeric COSE algorithm identifiers

CI-018mso_mdoc signing algorithms as numeric COSE algorithm identifiers CW-010Credential Offer parameter values treated as not trustworthy

All OID4VCI 1.0 requirements · OID4VCI protocol page