{"id":"GHSA-vg44-fw64-cpjx","aliases":[],"status":"published","title":"Incorrect Account Used for Signing","description":"### Impact\n\nAnybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index `0`), or with the legacy MEW/MyCrypto HD path, they are not affected.\n\nThe vulnerability impacts cases where the user signs a personal message or transaction without first adding the account. This includes cases where the user has already added the account in a previous session (i.e. they added the account, reset the application, then signed something). The serialization/deserialization process does restore a previously added account, but it doesn\u0026#39;t restore the index instructing the keyring to use that account for signing. As a result, after serializing then deserializing the keyring state, the account at index `0` is always used for signing even if it isn\u0026#39;t the current account.\n\n### Patches\n\nThis has been patched ([#14](https://github.com/MetaMask/eth-ledger-bridge-keyring/pull/14)) in version \u0026gt;=0.2.1 of [`eth-ledger-bridge-keyring`](https://www.npmjs.com/package/eth-ledger-bridge-keyring), and in version \u0026gt;=0.2.2 of [`@metamask/eth-ledger-bridge-keyring`](https://www.npmjs.com/package/@metamask/eth-ledger-bridge-keyring). Users are encouraged to migrate to the new package name.\n\n### Workarounds\n\nTo work around this problem without updating, you should remove then re-add the account before use. As long as the account was added during the lifetime of that process, signing with that account should work correctly.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [MetaMask/eth-ledger-bridge-keyring on GitHub](https://github.com/MetaMask/eth-ledger-bridge-keyring)\n* Email the MetaMask team at [hello@metamask.io](mailto:hello@metamask.io)","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2020-03-24T15:08:59Z","modified":"2023-01-09T05:02:14Z","fixes":[{"ecosystem":"npm","package":"eth-ledger-bridge-keyring","fixed_in":["0.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@metamask/eth-ledger-bridge-keyring","fixed_in":["0.2.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"eth-ledger-bridge-keyring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@metamask/eth-ledger-bridge-keyring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"eth-ledger-bridge-keyring","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@metamask/eth-ledger-bridge-keyring","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.2"}]}]}],"references":[{"url":"https://github.com/MetaMask/eth-ledger-bridge-keyring/security/advisories/GHSA-vg44-fw64-cpjx","tags":["web"]},{"url":"https://github.com/MetaMask/eth-ledger-bridge-keyring/pull/14","tags":["web"]},{"url":"https://github.com/MetaMask/eth-ledger-bridge-keyring/commit/f32e529d13a53e55f558d903534d631846dc26ce","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vg44-fw64-cpjx","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/1497","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1498","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-ETHLEDGERBRIDGEKEYRING-561121","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-vg44-fw64-cpjx","title":"Incorrect Account Used for Signing","description":"### Impact\n\nAnybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index `0`), or with the legacy MEW/MyCrypto HD path, they are not affected.\n\nThe vulnerability impacts cases where the user signs a personal message or transaction without first adding the account. This includes cases where the user has already added the account in a previous session (i.e. they added the account, reset the application, then signed something). The serialization/deserialization process does restore a previously added account, but it doesn\u0026#39;t restore the index instructing the keyring to use that account for signing. As a result, after serializing then deserializing the keyring state, the account at index `0` is always used for signing even if it isn\u0026#39;t the current account.\n\n### Patches\n\nThis has been patched ([#14](https://github.com/MetaMask/eth-ledger-bridge-keyring/pull/14)) in version \u0026gt;=0.2.1 of [`eth-ledger-bridge-keyring`](https://www.npmjs.com/package/eth-ledger-bridge-keyring), and in version \u0026gt;=0.2.2 of [`@metamask/eth-ledger-bridge-keyring`](https://www.npmjs.com/package/@metamask/eth-ledger-bridge-keyring). Users are encouraged to migrate to the new package name.\n\n### Workarounds\n\nTo work around this problem without updating, you should remove then re-add the account before use. As long as the account was added during the lifetime of that process, signing with that account should work correctly.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [MetaMask/eth-ledger-bridge-keyring on GitHub](https://github.com/MetaMask/eth-ledger-bridge-keyring)\n* Email the MetaMask team at [hello@metamask.io](mailto:hello@metamask.io)","status":"published","published":"2020-03-24T15:08:59Z","modified":"2023-01-09T05:02:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:36:03.040255Z"}],"osv":[{"id":"GHSA-vg44-fw64-cpjx","title":"Incorrect Account Used for Signing","description":"### Impact\n\nAnybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index `0`), or with the legacy MEW/MyCrypto HD path, they are not affected.\n\nThe vulnerability impacts cases where the user signs a personal message or transaction without first adding the account. This includes cases where the user has already added the account in a previous session (i.e. they added the account, reset the application, then signed something). The serialization/deserialization process does restore a previously added account, but it doesn\u0026#39;t restore the index instructing the keyring to use that account for signing. As a result, after serializing then deserializing the keyring state, the account at index `0` is always used for signing even if it isn\u0026#39;t the current account.\n\n### Patches\n\nThis has been patched ([#14](https://github.com/MetaMask/eth-ledger-bridge-keyring/pull/14)) in version \u0026gt;=0.2.1 of [`eth-ledger-bridge-keyring`](https://www.npmjs.com/package/eth-ledger-bridge-keyring), and in version \u0026gt;=0.2.2 of [`@metamask/eth-ledger-bridge-keyring`](https://www.npmjs.com/package/@metamask/eth-ledger-bridge-keyring). Users are encouraged to migrate to the new package name.\n\n### Workarounds\n\nTo work around this problem without updating, you should remove then re-add the account before use. As long as the account was added during the lifetime of that process, signing with that account should work correctly.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [MetaMask/eth-ledger-bridge-keyring on GitHub](https://github.com/MetaMask/eth-ledger-bridge-keyring)\n* Email the MetaMask team at [hello@metamask.io](mailto:hello@metamask.io)","status":"published","published":"2020-03-24T15:08:59Z","modified":"2021-08-23T14:40:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:57.348035Z"}]}}