AIKIDO-2026-10614

TL;DR

Affected versions of this package improperly allowed the approve operation to proceed without first ensuring the signer was authenticated. An attacker with access to a wallet session, compromised client state, or a context where approval could be triggered before authentication may be able to invoke approval flows and authorize a pending transaction or signature without the intended identity check. It could result in unauthorized transaction approval or signature confirmation on behalf of the victim.