{"id":"CVE-2026-86840","aliases":["EUVD-2026-72876","GHSA-wm9v-x9j6-gf6x"],"status":"published","title":"Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion","description":"The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0042,"percentile":0.36801,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639","CWE-862"],"published":"2026-09-08T15:29:48Z","modified":"2026-09-10T21:32:21Z","products":[{"vendor":"bitfrost.io","product":"bifrost"},{"vendor":"brokercap","product":"bifrost"}],"references":[{"url":"https://docs.bifrost.io/faq/what-are-vtokens"},{"url":"https://gist.github.com/prasanna8585/ffd112b1a125ca4c5533fdce45ef57c1","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86840"},{"url":"https://github.com/advisories/GHSA-wm9v-x9j6-gf6x"}],"sources":{"cve":[{"id":"CVE-2026-86840","title":"Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion","description":"The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.","status":"published","published":"2026-09-08T15:29:48.572Z","modified":"2026-09-10T18:27:49.91Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-862","CWE-639"],"updated_at":"2026-11-02T13:49:42.666099Z"}],"euvd":[{"id":"EUVD-2026-72876","description":"The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.","status":"published","published":"2026-09-08T15:29:48Z","modified":"2026-09-10T18:27:49Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:28:23.831795Z"}],"ghsa":[{"id":"GHSA-wm9v-x9j6-gf6x","title":"The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization...","description":"The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.","status":"published","published":"2026-09-08T18:31:54Z","modified":"2026-09-10T21:32:21Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:11:43.240477Z"}],"nvd":[{"id":"CVE-2026-86840","description":"The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.","status":"published","published":"2026-09-08T16:18:37.597Z","modified":"2026-09-10T19:17:36.98Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-02T14:12:44.436435Z"}]}}