AIKIDO-2026-214608

Nostr.Sdk is vulnerable to Improper Verification of Data Authenticity

Improper Verification of Data AuthenticityGHSA-v2xx-q3jc-2r8w Published 2 days ago

High Risk

This Affects:

Nostr.Sdk

0.40.0 - 0.44.7

Fixed in 0.44.8

Are you affected? Scan for Free

TL;DR

The NIP-47 wallet-connect response parser decrypts relay-provided events before verifying the event kind, computed id, signature, and expected wallet public key. Because the decryption peer is derived from the untrusted event author, successful decryption does not prove the configured wallet produced the event. A relay can deliver an event signed by a different key that is then parsed as a genuine wallet response, corrupting wallet state or driving the application to act on forged data. The fix verifies the event kind, id, signature, and exact configured wallet author before decrypting or parsing the plaintext.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application uses the Nostr Wallet Connect (NIP-47) client to send wallet requests and parse responses received from relays.