Research / Finding
Missing proposal body root verification F-NIMIQ-TENDERMINT-001
Public snapshot: 26 Sep 2026. Status, releases and attribution belong to each source below; none is inferred from another record.
Read the evidence · View in research browse
Recorded evidence
7.1high
Missing proposal body root verification
Fixed in: nimiq-blockchain v1.2.2
patched
details
Finding IDs F-NIMIQ-TENDERMINT-001 CVE CVE-2026-28402 GHSA GHSA-7wh6-rmxx-ww47 Status patched Fixed in nimiq-blockchain v1.2.2 CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE registry state PUBLISHED CVE state checked 23 Sep 2026 Upstream title Missing proposal body root verification Upstream CWE CWE-354 Upstream publication 27 Feb 2026 Upstream updated 27 Feb 2026 Metadata fetched 23 Sep 2026 Upstream @1seal credit @1seal: finder (accepted) F-NIMIQ-TENDERMINT-001: Verification failures. Proposal validation omits a required root check. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.
Mechanism source for F-NIMIQ-TENDERMINT-001
Security area (1seal assessment): Integrity. Proposal validation omits a required root check. Reviewed 24 Sep 2026.
Clarify or correct this record privately . The email subject includes the finding ID. For an existing case, continue the agreed private thread. Do not post unpublished vulnerability details in public issues. Research disclosure policy .
How this page groups evidence This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules .