p PatchFirst

PatchFirst · Latest vulnerabilities

@account-kit/smart-contracts vulnerabilities

Vulnerabilities published for @account-kit/smart-contracts in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. GHSA-56r6-ccm5-8hg3

    Critical · CVSS 9.3Fix available

    Alchemy Non-SMA and Webauthn Account Security Advisory

    ### Impact A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted. ### Patches Please direct creation of new wallets to either `createSemiModularAccount` on `AccountFactory.sol` or `createWebAuthnAccount` on `WebAuthnFactory.sol`.

    @account-kit/smart-contractsNode.js
    • Update to 4.52.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. GHSA-wfm2-rq5g-f8v5

    High · CVSS 8.7Fix available

    @account-kit/smart-contracts Allowlist Module Bypass Vulnerability

    ### Summary Allowlist module contains a bypass vulnerability ### Details The logic for using an allowlist on a Modular Account V2 contained a bug that allowed session keys to bypass any allowlist configuration ### Action If you are using @aa-sdk and/or @account-kit/smart-contracts between the versions of >=4.8.0 and <4.28.1, please upgrade to 4.28.2

    @account-kit/smart-contractsNode.js
    • Update to 4.28.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →