{"id":"GHSA-56r6-ccm5-8hg3","aliases":[],"status":"published","title":"Alchemy Non-SMA and Webauthn Account Security Advisory","description":"### Impact\nA potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted.\n### Patches\nPlease direct creation of new wallets to either `createSemiModularAccount` on `AccountFactory.sol` or `createWebAuthnAccount` on `WebAuthnFactory.sol`.","severity":{"version":"4.0","score":8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2025-07-21T14:20:40Z","modified":"2025-07-21T14:20:41Z","fixes":[{"ecosystem":"npm","package":"@account-kit/smart-contracts","fixed_in":["4.52.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@account-kit/smart-contracts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.42.0"},{"last_affected":"4.51.0"},{"fixed":"4.52.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@account-kit/smart-contracts","ranges":[{"type":"SEMVER","events":[{"introduced":"4.42.0"},{"fixed":"4.52.0"}]}]}],"references":[{"url":"https://github.com/alchemyplatform/modular-account/security/advisories/GHSA-56r6-ccm5-8hg3","tags":["web"]},{"url":"https://github.com/alchemyplatform/aa-sdk/commit/b343437a9e4a833c25fed7bc8785a815cbbae0ee","tags":["web"]},{"url":"https://github.com/alchemyplatform/modular-account/commit/2352c9b692935ba97d98619cb31ba1653eee241f","tags":["web"]},{"url":"https://github.com/advisories/GHSA-56r6-ccm5-8hg3"},{"url":"https://github.com/alchemyplatform/modular-account","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-56r6-ccm5-8hg3","title":"Alchemy Non-SMA and Webauthn Account Security Advisory","description":"### Impact\nA potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted.\n### Patches\nPlease direct creation of new wallets to either `createSemiModularAccount` on `AccountFactory.sol` or `createWebAuthnAccount` on `WebAuthnFactory.sol`.","status":"published","published":"2025-07-21T14:20:40Z","modified":"2025-07-21T14:20:41Z","cvss":[{"version":"4.0","score":8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:38:50.834587Z"}],"osv":[{"id":"GHSA-56r6-ccm5-8hg3","title":"Alchemy Non-SMA and Webauthn Account Security Advisory","description":"### Impact\nA potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted.\n### Patches\nPlease direct creation of new wallets to either `createSemiModularAccount` on `AccountFactory.sol` or `createWebAuthnAccount` on `WebAuthnFactory.sol`.","status":"published","published":"2025-07-21T14:20:40Z","modified":"2025-07-21T14:20:40Z","cvss":[{"version":"4.0","score":8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}