Utils.readChallengeTx does not verify the server account signature

Description

The Utils.readChallengeTx function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the serverAccountID has signed the transaction.

Recommendation

Update the stellar-sdk package to the latest compatible version. Followings are version details:

• Affected version(s): < 8.2.3
• Patched version(s): 8.2.3

References

• GHSA-6cgh-hjpw-q3gq
• CVE-2021-32738
• CWE-287
• CWE-347
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• xdlocalstorage does not verify request origin - CVE-2020-11610
• Strapi does not verify the access or ID tokens issued during the OAuth flow - CVE-2023-22893
• Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - @strapi/plugin-users-permissions - CVE-2026-22706
• KaTeX's `\includegraphics` does not escape filename - CVE-2024-28245

You might also like:

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

stellar-sdk