Plafer

**Name of the Vulnerable Software and Affected Versions** Tendermint versions prior to 0.28.0 **Description** The issue concerns a potential attack via improper verification of cryptographic signatures, affecting users of the tendermint-light-client and related packages for light client verification. The light client does not check if the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector. This could allow someone to fool a light client by finding a header from an untrusted chain that satisfies other verification conditions, such as having enough overlapping validator signatures. The attack vector is currently theoretical, with no proof-of-concept existing to exploit it on live networks. **Recommendations** For versions prior to 0.28.0, upgrade to version 0.28.0 to resolve the issue. As a temporary workaround, consider restricting the use of the tendermint-light-client and related packages until the upgrade is applied. Avoid using the light client verification with untrusted headers until the issue is resolved. At the moment, there are no other workarounds available.