GHSA-wfm2-rq5g-f8v5 @account-kit/smart-contracts Allowlist Module Bypass Vulnerability
Session keys can bypass allowlist configurations in Modular Account V2, allowing unauthorized actions if specific versions are used.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-wfm2-rq5g-f8v5?
GHSA-wfm2-rq5g-f8v5 is a vulnerability in @account-kit/smart-contracts, published on 29 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Summary
Allowlist module contains a bypass vulnerability
Details
The logic for using an allowlist on a Modular Account V2 contained a bug that allowed session keys to bypass any allowlist configuration
Action
If you are using @aa-sdk and/or @account-kit/smart-contracts between the versions of >=4.8.0 and <4.28.1, please upgrade to 4.28.2
Which versions are affected by GHSA-wfm2-rq5g-f8v5?
2 open source packages ship an affected version, including @account-kit/smart-contracts.
| Package | Affected | Fixed in |
|---|---|---|
@account-kit/smart-contracts npm | From 4.8.0 | 4.28.2 |
@account-kit/smart-contracts npm | From 4.8.0 | 4.28.2 |
How do I fix GHSA-wfm2-rq5g-f8v5?
Upgrade @account-kit/smart-contracts to 4.28.2 or later.
Is GHSA-wfm2-rq5g-f8v5 being exploited?
There is no known exploitation of GHSA-wfm2-rq5g-f8v5 in the wild and no public exploit code.