PkgSeer

Vulnerability GO-2026-6582

Unknown

6 hours ago

Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go

v1.7.14 - v1.7.19

Summary

Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller in github.com/klever-io/klever-go

Details

Klever-Go Account takeover: kleverUpdateAccountPermission authorizes on attacker-controlled RecipientAddr instead of the authenticated caller in github.com/klever-io/klever-go

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go

v1.7.14 - v1.7.19 GO-2026-6581

Klever-Go: /log controls global node logging in github.com/klever-io/klever-go

v1.7.14 - v1.7.19 GO-2026-6583

Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go

v1.7.14 - v1.7.19 GO-2026-6584

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go

v1.7.14 - v1.7.19 GO-2026-6585

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go

v1.7.14 - v1.7.19 GO-2026-6586

View all vulnerabilities for these packages

Impacted packages

github.com/klever-io/klever-go

Timeline

Published

6 hours ago

Last Modified

6 hours ago