PT-2026-21963 · Unknown · Chia Blockchain

Danimlzg · Published 2026-02-25 · Updated 2026-03-05 · CVE-2026-3193

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chia Blockchain version 2.1.0

Description A cross-site request forgery condition exists in Chia Blockchain version 2.1.0. The issue is related to an unknown function within the /send transaction file. The attack can be performed remotely and requires a high level of complexity, with exploitability considered difficult. The exploit is publicly available. The vendor was informed of the issue, but a bug bounty report was rejected with the justification that the issue is by design and user host security is the responsibility of the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Missing Authorization

Weakness Enumeration

CWE-352

CWE-862

Related Identifiers

CVE-2026-3193

Affected Products

Chia Blockchain

References · 8

• 🔥❌ https://github.com/Danimlzg/chia-rpc-auth-bypass.git · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2026-3193 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3193 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2027100367243129070 · Twitter Post
• https://vuldb.com/?id.347749 · Note
• https://t.me/cveNotify/154245 · Telegram Post
• https://vuldb.com/?ctiid.347749 · Note
• https://twitter.com/CVEnew/status/2027099317325172795 · Twitter Post