# Android buyer verification SDK contains critical vulneralbility

**URL:** <https://developer.squareup.com/forums/t/android-buyer-verification-sdk-contains-critical-vulneralbility/26681>\
**Category:** Questions\
**Tags:** in-app-payments-sdk\
**Created:** [July 1, 2026, 1:42pm UTC](https://developer.squareup.com/forums/t/android-buyer-verification-sdk-contains-critical-vulneralbility/26681 "2026-07-01T13:42:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![paul\_atg](https://avatars.discourse-cdn.com/v4/letter/p/2acd7d/32.png) [@paul\_atg](https://developer.squareup.com/forums/u/paul_atg)\
**Post date:** [July 1, 2026, 1:42pm UTC](https://developer.squareup.com/forums/t/android-buyer-verification-sdk-contains-critical-vulneralbility/26681/1 "2026-07-01T13:42:01Z")

</div>

Hi team,

We have been alerted by our security scanning service that the Square In-App Payments Buyer Verification SDK contains a transitive dependency with a known critical security vulnerability.  
Specifically, the vulnerability originates from the Bouncy Castle cryptography library pulled in by the Netcetera 3DS SDK.

Here is the exact dependency path identified in our build:

com.squareup.sdk.in-app-payments:buyer-verification:1.6.8  
└─ buyer-verification-internals:1.6.8  
└─ com.netcetera.android-3dssdk:3ds-sdk:2.5.1.0  
└─ org.bouncycastle:bcprov-jdk15to18:1.77 ← Vulnerable Version

Could you please pass this along to your engineering team so an updated version of the `buyer-verification` SDK can be released to resolve these critical vulnerabilities?

Thanks

---

<div class="post-metadata">

**Author:** ![ashley-square](https://avatars.discourse-cdn.com/v4/letter/a/5f9b8f/32.png) [@ashley-square](https://developer.squareup.com/forums/u/ashley-square)\
**Post date:** [July 7, 2026, 3:42pm UTC](https://developer.squareup.com/forums/t/android-buyer-verification-sdk-contains-critical-vulneralbility/26681/2 "2026-07-07T15:42:36Z")

</div>

Thank you! I am flagging this with our engineering team now and will report back to you shortly.

---

<div class="post-metadata">

**Author:** ![paul\_atg](https://avatars.discourse-cdn.com/v4/letter/p/2acd7d/32.png) [@paul\_atg](https://developer.squareup.com/forums/u/paul_atg)\
**Post date:** [July 15, 2026, 1:03pm UTC](https://developer.squareup.com/forums/t/android-buyer-verification-sdk-contains-critical-vulneralbility/26681/3 "2026-07-15T13:03:22Z")

</div>

Hey @ashley-square , do you have any updates regarding the above?

---

<div class="post-metadata">

**Author:** ![ashley-square](https://avatars.discourse-cdn.com/v4/letter/a/5f9b8f/32.png) [@ashley-square](https://developer.squareup.com/forums/u/ashley-square)\
**Post date:** [July 15, 2026, 1:18pm UTC](https://developer.squareup.com/forums/t/android-buyer-verification-sdk-contains-critical-vulneralbility/26681/4 "2026-07-15T13:18:48Z")

</div>

Confirmed this will be corrected in our next release but I don’t yet have timing. Thank you again for flagging this.

---

<div class="post-metadata">

**Author:** ![ashley-square](https://avatars.discourse-cdn.com/v4/letter/a/5f9b8f/32.png) [@ashley-square](https://developer.squareup.com/forums/u/ashley-square)\
**Post date:** [July 22, 2026, 5:16pm UTC](https://developer.squareup.com/forums/t/android-buyer-verification-sdk-contains-critical-vulneralbility/26681/5 "2026-07-22T17:16:48Z")

</div>

We just released 1.6.9 and corrected this issue! Thank you again for flagging. [Mobile SDKs: 2026-07-22 Changelog](https://developer.squareup.com/docs/changelog/mobile-logs/2026-07-22)