Improper signature verification in FreeFrom K.K. "FreeFrom - the nostr client" App for…
Priority LOW 32CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-347.
Summary
Improper verification of cryptographic signature issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. The affected app cannot detect event data with invalid signatures.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Fixed "FreeFrom - the nostr client" App for Android (FreeFrom K.K.): 1.3.5"FreeFrom - the nostr client" App for iOS (FreeFrom K.K.): 1.3.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FreeFrom K.K. | "FreeFrom - the nostr client" App for Android | before 1.3.5 | 1.3.5 | Patch available | CNA |
| FreeFrom K.K. | "FreeFrom - the nostr client" App for iOS | before 1.3.5 | 1.3.5 | Patch available | CNA |
- "FreeFrom - the nostr client" App for Android VendorFreeFrom K.K. Affected before 1.3.5 Fixed in 1.3.5 Patch available CNA
- "FreeFrom - the nostr client" App for iOS VendorFreeFrom K.K. Affected before 1.3.5 Fixed in 1.3.5 Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freefrom_kk:freefrom_the_nostr_client_app:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:freefrom_kk:freefrom_the_nostr_client_app:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA "FreeFrom - the nostr client" App for Android (FreeFrom K.K.) Fixed in 1.3.5
- Fix · CNA "FreeFrom - the nostr client" App for iOS (FreeFrom K.K.) Fixed in 1.3.5
Timeline
- 2026-10-02 Threatist record created from CVE-2024-36277
- 2026-10-03 Alias added: GHSA-xmvf-wm3q-gh2f
References
More FreeFrom K.K. vulnerabilities
- TI-2024-24105 Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App… CVSS 3.1MEDIUM 5.3
- TI-2024-24095 Reliance on obfuscation or encryption of security-relevant inputs without integrity… CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-36277 · CVE Program
- CVE-2024-36277 · NVD
- FIRST EPSS
- GHSA-xmvf-wm3q-gh2f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences