Improper Authorization Affecting @openzeppelin/confidential-contracts package, versions <0.3.2>=0.4.0-rc.0 <0.4.2>=0.5.0-rc.0 <0.5.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Improper Authorization vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-OPENZEPPELINCONFIDENTIALCONTRACTS-20158601
- published27 Sept 2026
- disclosed25 Sept 2026
- creditUnknown
Introduced: 25 Sep 2026
New CVE NOT AVAILABLE CWE-285 (opens in a new tab)How to fix?
Upgrade @openzeppelin/confidential-contracts to version 0.3.2, 0.4.2, 0.5.2 or higher.
Overview
@openzeppelin/confidential-contracts is a Smart Contract library for use with confidential coprocessors
Affected versions of this package are vulnerable to Improper Authorization via the release and vestedAmount functions in VestingWalletConfidential.sol, which consume encrypted FHE handles returned by a caller-supplied token (via confidentialTransfer and confidentialBalanceOf) without verifying that the token holds ACL authority over those handles. Because FHE handles are global and not namespaced by token, a malicious token can return a handle belonging to a different ERC7984 token held by the wallet, causing the wallet to compute over and enable disclosure of a confidential balance it does not intend to expose. An attacker who controls or deploys a malicious token contract can therefore read the confidential balance of any other ERC7984 token held by the vesting wallet.