🛡️ GHSA-wfm2-rq5g-f8v5 — smart-contracts

⚪ Unknown ✅ No Known Exploit CWE-288 OSV

N/A

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

@account-kit/smart-contracts Allowlist Module Bypass Vulnerability

Summary

Allowlist module contains a bypass vulnerability

Details

The logic for using an allowlist on a Modular Account V2 contained a bug that allowed session keys to bypass any allowlist configuration

Action

If you are using @aa-sdk and/or @account-kit/smart-contracts between the versions of >=4.8.0 and <4.28.1, please upgrade to 4.28.2

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. Rated impact: confidentiality none, integrity high, availability none.

Weakness class

GHSA-wfm2-rq5g-f8v5 is classified as CWE-288: Authentication Bypass Using an Alternate Path. A secondary route into the application skips the authentication that the primary route enforces.

Affected software

GHSA-wfm2-rq5g-f8v5 is recorded against 1 package.

@account-kit/smart-contracts

Timeline and source

Published on 29 April 2025. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Web)
github.com (Package)

Details

Severity Unknown

CVSS Score N/A

CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

CWE CWE-288

Public Exploit ✅ No

Source OSV

Published 2025-04-29

Updated 2026-08-20

Modified 2025-04-29

Fix URL N/A

Affected Packages

Software	From version	Fixed in
@account-kit/smart-contracts	—	—

References

WEB https://github.com/alchemyplatform/aa-sdk/security/advisories/GHSA-wfm2-rq5g-f8v5

WEB https://github.com/alchemyplatform/aa-sdk/commit/b65bafdb9eec3a009df2cbabf09a35a76550e9d0

PACKAGE https://github.com/alchemyplatform/aa-sdk

🔗 NVD 🔗 Mitre

Similar Threats

High GHSA-56r6-ccm5-8hg3

Free Vulnerability Check

Is your site affected by GHSA-wfm2-rq5g-f8v5?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against GHSA-wfm2-rq5g-f8v5 and other known CVE records.

Scan My Site Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.