Read the docs
TI-2021-12406 Aliases CVE-2021-32738GHSA-6cgh-hjpw-q3gq

Utils.readChallengeTx does not verify the server account signature

Priority LOW 29CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the `serverAccountID` has signed the transaction. In js-stellar-sdk before version 8.2.3, the function does not verify that the server has signed the transaction. Applications that also used `Utils.verifyChallengeTxThreshold` or `Utils.verifyChallengeTxSigners` to verify the signatures including the server signature on the challenge transaction are unaffected as those functions verify the server signed the transaction. Applications calling `Utils.readChallengeTx` should update to version 8.2.3, the first version with a patch for this vulnerability, to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction.

Why it matters now

EPSS 0.00514 44th percentileScored 2026-11-07
Fix Fixed js-stellar-sdk (stellar): 8.2.3stellar-sdk (npm): 8.2.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
stellarjs-stellar-sdkbefore 8.2.38.2.3Patch availableCNA
—stellar-sdk (npm)before 8.2.38.2.3Patch availableGHSA-6cgh-hjpw-q3gq
  • js-stellar-sdk Vendorstellar Affected before 8.2.3 Fixed in 8.2.3 Patch available CNA
  • stellar-sdk (npm) Vendor— Affected before 8.2.3 Fixed in 8.2.3 Patch available GHSA-6cgh-hjpw-q3gq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:stellar:js-stellar-sdk:*:*:*:*:*:node.js:*:*before 8.2.3Vulnerablestellar
  • cpe:2.3:a:stellar:js-stellar-sdk:*:*:*:*:*:node.js:*:* Versions before 8.2.3 Vulnerable ·stellar

Remediation

  • Fix · CNA js-stellar-sdk (stellar) Fixed in 8.2.3
  • Fix · GHSA-6cgh-hjpw-q3gq stellar-sdk (npm) Fixed in 8.2.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32738
  2. 2026-10-03 Alias added: GHSA-6cgh-hjpw-q3gq

References

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences