Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:36431
HistoryJul 22, 2022 - 4:54 a.m.

Authentication Bypass

2022-07-2204:54:26
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
12
authentication
bypass
vulnerability
openzeppelin/contracts
abi.decode
isvalidsignaturenow
signaturechecker.sol
_supportserc165interfacedue
erc165checker.sol
malicious user

EPSS

0.001

Percentile

26.7%

@openzeppelin/contracts is vulnerable to authentication bypass. The vulnerability exists because the abi.decode is getting unexpectedly reverted in the isValidSignatureNow function of SignatureChecker.sol and _supportsERC165Interfacedue function of ERC165Checker.soldue to the incorrect assumption about abi.decode, allowing a malicious user to pass an invalid signature to the system and become authenticated.

EPSS

0.001

Percentile

26.7%

Related for VERACODE:36431