AIKIDO-2026-10418

TL;DR

Affected versions of this package contain a low-severity issue in verify that could allow signatures generated by an attacker with access to a secret key to be accepted as valid for any message under that same key, weakening message-binding guarantees and primarily impacting systems that rely on non-repudiation. An attacker who obtains or controls a secret key could exploit this flaw by producing a signature once and reusing it to falsely assert authenticity over different messages, potentially undermining auditability, proof of origin, and trust in signed records.