N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-56r6-ccm5-8hg3

GHSA-56r6-ccm5-8hg3: Alchemy Non-SMA and Webauthn Account Security Advisory

Impact

A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted.

Patches

Please direct creation of new wallets to either createSemiModularAccount on AccountFactory.sol or createWebAuthnAccount on WebAuthnFactory.sol.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-56r6-ccm5-8hg3

GHSA-56r6-ccm5-8hg3:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@account-kit/smart-contracts	npm	>= 4.42.0, <= 4.51.0	4.52.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies within the smart contract factory responsible for deploying new user accounts on the Alchemy platform. The analysis of the security advisory and the associated commits indicates that the createWebAuthnAccount function within the AccountFactory.sol contract was flawed.

The root cause appears to be an improper authentication issue (CWE-287) during the account creation process. The vulnerable function likely failed to correctly configure the validation logic for WebAuthn credentials, potentially allowing an attacker to create an account for which they could bypass authentication.

The mitigation strategy involved two key changes:

On-Chain Contract Change (Commit 2352c9b692935ba97d98619cb31ba1653eee241f): A new, specialized WebAuthnFactory.sol contract was introduced. This contract contains a corrected version of the createWebAuthnAccount function. The original function on AccountFactory.sol is now deprecated, and developers are instructed to use the new factory. The evidence for this is the modification of test files to use the new factory, indicating a clear migration away from the old, vulnerable implementation.
Client-Side SDK Update (Commit b343437a9e4a833c25fed7bc8785a815cbbae0ee): The aa-sdk was patched to direct all WebAuthn account creation requests to the address of the new WebAuthnFactory contract. This ensures that even without direct smart contract interaction, applications using the SDK will use the secure account creation method.

For a security engineer, this means that any system creating Alchemy smart accounts must be updated. It is critical to ensure that the application logic no longer calls createWebAuthnAccount on the old AccountFactory contract. Instead, all new WebAuthn accounts must be created through the new WebAuthnFactory. Updating the @account-kit/smart-contracts package to version 4.52.0 or later is the recommended course of action.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.