Junglewise Threat Intelligence

CVE-2026-56744: @bsv/wallet-toolbox storage output validation bypass

CVE-2026-56744 · Severity: medium · CVSS 4 · Published 2026-09-24

Executive brief

These npm packages handle cryptocurrency wallet operations and payment creation in blockchain applications. When using remote storage (the default configuration), the wallet fails to verify that payment recipients returned by the storage server match what the user requested. An attacker controlling the storage server could redirect payments to a different address while the wallet UI continues to show the originally requested recipient, causing users to unknowingly pay attackers instead of intended recipients.

Technical details

The vulnerability is a missing output script validation in the buildSignableTransaction method. When createAction runs against a remote StorageClient, the storage server returns transaction outputs to build. buildSignableTransaction uses each non-change output's lockingScript directly from the storage response and signs it without comparing it to the lockingScript the caller supplied in args.outputs. Similarly, WalletPermissionsManager.createAction parses the built transaction but only inspects inputs and fees, not outputs. An attacker who controls or compromises the storage operator (the default being storage.babbage.systems over BRC-103 AuthFetch with mutual auth) can store and return a substituted recipient script, which the wallet will sign and broadcast verbatim while the UI still displays the original recipient. The attacker model is a storage operator or someone with access to storage infrastructure—not a passive network MITM. Proof-of-concept testing confirmed that payments requested to one address were built, signed, and broadcast to a different address with no warning. Patches released in version 2.4.0 add verifyRequestedOutputsUnchanged and verifyUnrequestedOutputsAreChangeOrCommission to validate storage outputs before signing.

Affected products

  • bsv-blockchain @bsv/wallet-toolbox 1.1.47 to 2.1.21; fixed in 2.4.0
  • bsv-blockchain @bsv/wallet-toolbox-client 1.1.47 to 2.1.21; fixed in 2.4.0
  • bsv-blockchain @bsv/wallet-toolbox-mobile 1.3.21 to 2.1.21; fixed in 2.4.0

Timeline

  • 2026-09-24: disclosed: Advisory published as GHSA-36f9-7rg5-cpf8
  • 2026-07-06: patched: Fix released in version 2.4.0

References