GitHub Advisoryadvisory · npm
GHSA-56r6-ccm5-8hg3 Alchemy Non-SMA and Webauthn Account Security Advisory
HIGH
Official page ↗
- Ecosystem
- npm
- Packages
- @account-kit/smart-contracts
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
- Weaknesses
- CWE-287
- Reviewed
- 2025-07-21
Affected packages
• npm @account-kit/smart-contracts: >= 4.42.0, < 4.52.0 → fixed in 4.52.0
Description
Impact
A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted.
Patches
Please direct creation of new wallets to either `createSemiModularAccount` on `AccountFactory.sol` or `createWebAuthnAccount` on `WebAuthnFactory.sol`.
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://github.com/alchemyplatform/modular-account/security/advisories/GHSA-56r6-ccm5-8hg3 web
- https://github.com/alchemyplatform/aa-sdk/commit/b343437a9e4a833c25fed7bc8785a815cbbae0ee web
- https://github.com/alchemyplatform/modular-account/commit/2352c9b692935ba97d98619cb31ba1653eee241f web
- https://github.com/alchemyplatform/modular-account package