PT-2025-31716 · Npm · @Account-Kit/Smart-Contracts

Published 2025-07-21 · Updated 2025-07-21

OSV

CVSS v4.0

8.0

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Impact

A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted.

Patches

Please direct creation of new wallets to either createSemiModularAccount on AccountFactory.sol or createWebAuthnAccount on WebAuthnFactory.sol.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

GHSA-56R6-CCM5-8HG3

Affected Products

@Account-Kit/Smart-Contracts

References · 5

• https://osv.dev/vulnerability/GHSA-56r6-ccm5-8hg3 · Vendor Advisory
• https://github.com/alchemyplatform/aa-sdk/commit/b343437a9e4a833c25fed7bc8785a815cbbae0ee · Note
• https://github.com/alchemyplatform/modular-account/security/advisories/GHSA-56r6-ccm5-8hg3 · Note
• https://github.com/alchemyplatform/modular-account · Note
• https://github.com/alchemyplatform/modular-account/commit/2352c9b692935ba97d98619cb31ba1653eee241f · Note