CVE-2026-86840

9.1 Critique

Publiée le 08/09/2026 à 18:18 · Modifiée le 10/09/2026 à 21:17 · Analyse NVD reportée · Source : cret@cert.org

Description

The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.

Traduire en français

Produits concernés

Bitfrost.io Bifrost

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-639
CWE-862

Références

https://docs.bifrost.io/faq/what-are-vtokens
https://gist.github.com/prasanna8585/ffd112b1a125ca4c5533fdce45ef57c1
https://gist.github.com/prasanna8585/ffd112b1a125ca4c5533fdce45ef57c1

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories