Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities by Bitfrost.io
CVE-2026-86840 (GCVE-0-2026-86840)
Vulnerability from nvd – Published: 2026-09-08 15:29 – Updated: 2026-09-08 15:29
VLAI
EPSS
VEX
Title
Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion
Summary
The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.
Severity
No CVSS data available.
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bitfrost.io | Bifrost |
Affected:
0 , ≤ 2022.02
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Bifrost",
"vendor": "Bitfrost.io",
"versions": [
{
"lessThanOrEqual": "2022.02",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel\u0027s recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T15:29:48.572Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://docs.bifrost.io/faq/what-are-vtokens"
},
{
"url": "https://gist.github.com/prasanna8585/ffd112b1a125ca4c5533fdce45ef57c1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion",
"x_generator": {
"engine": "VINCE 3.0.45",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-86840"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-86840",
"datePublished": "2026-09-08T15:29:48.572Z",
"dateReserved": "2026-09-08T14:43:37.022Z",
"dateUpdated": "2026-09-08T15:29:48.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86840 (GCVE-0-2026-86840)
Vulnerability from cvelistv5 – Published: 2026-09-08 15:29 – Updated: 2026-09-08 15:29
VLAI
EPSS
VEX
Title
Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion
Summary
The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.
Severity
No CVSS data available.
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bitfrost.io | Bifrost |
Affected:
0 , ≤ 2022.02
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Bifrost",
"vendor": "Bitfrost.io",
"versions": [
{
"lessThanOrEqual": "2022.02",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel\u0027s recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en"
}
]
},
{
"descriptions": [
{
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T15:29:48.572Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://docs.bifrost.io/faq/what-are-vtokens"
},
{
"url": "https://gist.github.com/prasanna8585/ffd112b1a125ca4c5533fdce45ef57c1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion",
"x_generator": {
"engine": "VINCE 3.0.45",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-86840"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-86840",
"datePublished": "2026-09-08T15:29:48.572Z",
"dateReserved": "2026-09-08T14:43:37.022Z",
"dateUpdated": "2026-09-08T15:29:48.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}