What is the CVSS score of CVE-2026-34068?

CVE-2026-34068 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34068?

Yes, a patch is available for CVE-2026-34068. Update the affected software to the latest version immediately.

Nimiq Core CVE-2026-34068

EUVD-2026-25086 MEDIUM

Improper Verification of Cryptographic Signature (CWE-347)

2026-04-22 https://github.com/nimiq/core-rs-albatross

GHSA-pf4j-pf3w-95f9

Jwt Attack Information Disclosure

6.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 23, 2026 - 07:06 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 19:31 euvd

EUVD-2026-25086

Analysis Generated

Apr 22, 2026 - 19:31 vuln.today

Patch released

Apr 22, 2026 - 19:31 nvd

Patch available

CVE Published

Apr 22, 2026 - 19:22 nvd

MEDIUM 6.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

16 cargo packages depend on nimiq-transaction (10 direct, 6 indirect)

Ecosystem-wide dependent count for version 0.2.0.

DescriptionGitHub Advisory

Impact

The staking contract accepts UpdateValidator transactions that set new_voting_key=Some(...) while omitting new_proof_of_knowledge. this skips the proof-of-knowledge requirement that is needed to prevent BLS rogue-key attacks when public keys are aggregated.

Because tendermint macro block justification verification aggregates validator voting keys and verifies a single aggregated BLS signature against that aggregate public key, a rogue-key voting key in the validator set can allow an attacker to forge a quorum-looking justification while only producing a single signature.

While the impact is critical, the exploitability is low: The voting keys are fixed for the epoch, so the attacker would need to know the next epoch validator set (chosen through VRF), which is unlikely.

Patches

The patch for this vulnerability is included as part of v1.3.0.

Workarounds

No known workarounds.

AnalysisAI

The Nimiq staking contract accepts UpdateValidator transactions that omit proof-of-knowledge validation when updating voting keys, enabling rogue-key attacks against BLS signature aggregation used in Tendermint block justification. An attacker who can predict the next epoch's validator set could forge quorum-appearing block justifications with a single signature. Exploitation is constrained by the requirement to predict future validator set composition via VRF, making real-world attacks unlikely despite the critical cryptographic impact. Vendor-released patch v1.3.0 addresses the vulnerability.

Technical ContextAI

Nimiq's consensus mechanism uses BLS (Boneh-Lynn-Shacham) signature aggregation to verify block justifications from validator sets. When a voting key is updated via UpdateValidator transaction, the contract should validate a proof-of-knowledge (PoK) to prevent rogue-key attacks-a known vulnerability class (CWE-347: Improper Verification of Cryptographic Signature) in systems that aggregate public keys without PoK. The vulnerability exists because the staking contract allows setting new_voting_key with Some(...) while omitting new_proof_of_knowledge, bypassing the cryptographic safeguard. An attacker exploiting this can inject a malicious voting key into the validator set such that when aggregate verification is performed (aggregating all voting keys and verifying against the aggregate public key), the attacker's single signature appears as part of a valid quorum signature, forging consensus. The affected CPE is pkg:rust/nimiq-transaction, indicating the vulnerability lies in the transaction validation layer of the Nimiq Albatross consensus protocol.

RemediationAI

Apply vendor patch: upgrade to Nimiq Core v1.3.0 or later (https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0). The patch enforces mandatory proof-of-knowledge validation when UpdateValidator transactions set new voting keys, as detailed in commit e7f0ab7d2115e17d6e5548ddc60f10df1a5d645f. No workarounds exist per vendor guidance. Organizations running Nimiq validators should prioritize this patch to restore cryptographic guarantees of the consensus mechanism, particularly if operating in environments where validator set prediction attacks are a concern (though such prediction is considered impractical against VRF-based selection).