TI-2023-09738 Aliases CVE-2023-23940 GHSA-626q-v9j4-mcp4

OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass

LOW 28CWE-345Published 2023-02-03 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: Low · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0022 12th percentileScored 2026-11-07

Fix Fixed cairo-contracts (OpenZeppelin): 0.6.1openzeppelin-cairo-contracts (PyPI): 0.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenZeppelin	cairo-contracts	0.2.0 to before 0.6.1	0.6.1	Patch available	CNA
—	openzeppelin-cairo-contracts (PyPI)	0.2.0 to before 0.6.1	0.6.1	Patch available	GHSA-626q-v9j4-mcp4

cairo-contracts VendorOpenZeppelin Affected 0.2.0 to before 0.6.1 Fixed in 0.6.1 Patch available CNA
openzeppelin-cairo-contracts (PyPI) Vendor— Affected 0.2.0 to before 0.6.1 Fixed in 0.6.1 Patch available GHSA-626q-v9j4-mcp4

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openzeppelin:contracts::::::cairo::*	0.2.0 to before 0.6.1	Vulnerable	OpenZeppelin

cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:cairo:*:* Versions 0.2.0 to before 0.6.1 Vulnerable ·OpenZeppelin

Remediation

Fix · CNA cairo-contracts (OpenZeppelin) Fixed in 0.6.1
Fix · GHSA-626q-v9j4-mcp4 openzeppelin-cairo-contracts (PyPI) Fixed in 0.6.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-23940
2026-10-03 Alias added: GHSA-626q-v9j4-mcp4

References

Patch 1

https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2fd916f73297632f899aca9299

Advisory 2

Other 2

TI-2022-13196 OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli CVSS 3.1MEDIUM 6.5
TI-2021-16554 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
TI-2021-16553 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
TI-2021-18096 UUPSUpgradeable vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 9.8
TI-2022-13238 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts CVSS 3.1HIGH 7.5
TI-2022-13212 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false CVSS 3.1HIGH 7.5

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences