GHSA-56r6-ccm5-8hg3
Alchemy Non-SMA and Webauthn Account Security Advisory
GHSA-56r6-ccm5-8hg3 is a high vulnerability (CVSS 8.0) in @account-kit/smart-contracts, published July 21, 2025. No source lists public exploit code. Fixed in @account-kit/smart-contracts 4.52.0.
- Severity
- 8.0 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.52.0@account-kit/smart-contracts +1 more
Description
Impact
A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted.
Patches
Please direct creation of new wallets to either createSemiModularAccount on AccountFactory.sol or createWebAuthnAccount on WebAuthnFactory.sol.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@account-kit/smart-contractsnpm | 4.42.0 to 4.51.0 | 4.52.0 |
@account-kit/smart-contractsnpm | 4.42.0 up to 4.52.0 | 4.52.0 |
What each source reports
GitHub Advisories Score used
Alchemy Non-SMA and Webauthn Account Security Advisory
Impact
A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted.
Patches
Please direct creation of new wallets to either createSemiModularAccount on AccountFactory.sol or createWebAuthnAccount on WebAuthnFactory.sol.
- Record
GHSA-56r6-ccm5-8hg3- CVSS 4.0
- 8.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
Alchemy Non-SMA and Webauthn Account Security Advisory
Impact
A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted.
Patches
Please direct creation of new wallets to either createSemiModularAccount on AccountFactory.sol or createWebAuthnAccount on WebAuthnFactory.sol.
- Record
GHSA-56r6-ccm5-8hg3- CVSS 4.0
- 8.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-287
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/alchemyplatform/modular-account/security/advisories/GHSA-56r6-ccm5-8hg3