GHSA-56r6-ccm5-8hg3 Alchemy Non-SMA and Webauthn Account Security Advisory
Old Alchemy account deployment functions had a security issue mitigated by using new factory methods for smart wallet creation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-56r6-ccm5-8hg3?
GHSA-56r6-ccm5-8hg3 is a vulnerability in @account-kit/smart-contracts, published on 21 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted.
Patches
Please direct creation of new wallets to either createSemiModularAccount on AccountFactory.sol or createWebAuthnAccount on WebAuthnFactory.sol.
Which versions are affected by GHSA-56r6-ccm5-8hg3?
2 open source packages ship an affected version, including @account-kit/smart-contracts.
| Package | Affected | Fixed in |
|---|---|---|
@account-kit/smart-contracts npm | From 4.42.0 | 4.52.0 |
@account-kit/smart-contracts npm | From 4.42.0 | 4.52.0 |
How do I fix GHSA-56r6-ccm5-8hg3?
Upgrade @account-kit/smart-contracts to 4.52.0 or later.
Is GHSA-56r6-ccm5-8hg3 being exploited?
There is no known exploitation of GHSA-56r6-ccm5-8hg3 in the wild and no public exploit code.