EUVD-2026-66705
GHSA-3763-qp59-59vf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attacker fully controls validity_start_height on their own transaction; no privileges or user interaction needed; impact is financial integrity only with no confidentiality or availability loss.
Primary rating from Vendor (https://github.com/nimiq/core-rs-albatross).
CVSS VectorVendor: https://github.com/nimiq/core-rs-albatross
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Impact
The validity store treats a transaction with stored block_number = X as "in window" only when X > last_bn - transaction_validity_window_blocks (strict inequality). However the protocol's Transaction::is_valid_at accepts a transaction for inclusion in any block in [validity_start_height - blocks_per_batch, validity_start_height + window - 1]. By choosing validity_start_height = X + blocks_per_batch (the largest value still compatible with first inclusion at block X), an attacker can replay the same signed transaction in any block B such that X + window < B < validity_start_height + window, i.e., a contiguous window of blocks_per_batch - 1 blocks (59 on MainNet, ~10 minutes) during which the replay-protection check fails to flag it. The same transaction is then executed twice: the sender is debited twice, the recipient credited twice.
Patches
https://github.com/nimiq/core-rs-albatross/pull/3772
Workarounds
No known workarounds
AnalysisAI
Off-by-one error in Nimiq Albatross' validity store enables transaction replay attacks, causing double execution of any crafted transaction on MainNet. Versions of nimiq-blockchain up to and including 1.5.0 contain a strict-inequality comparison that prematurely expires replay protection by up to 59 blocks (~10 minutes), while the protocol continues to accept the transaction as valid. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be able to submit transactions to the Nimiq Albatross peer-to-peer network, which is standard capability for any network participant and requires no authentication (consistent with CVSS PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects the financial integrity impact directly: no authentication or elevated privileges required, network accessible, high integrity loss from double-spend execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade nimiq-blockchain to version 1.5.1 or later, which corrects the strict inequality in the validity store to align replay-protection expiry with the protocol's is_valid_at range. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Nimiq Albatross deployments and confirm versions in use against nimiq-blockchain 1.5.0 and earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-193 – Off-by-one Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today