CVE-2019-7167

Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a consistency check, and consequently transform the proof of one statement into an ostensibly valid proof of a different statement, thereby breaking the soundness of the proof system. This misled the original Sprout zk-SNARK verifier into accepting the correctness of a transaction.

• CWE-754

• http://fortune.com/2019/02/05/zcash-vulnerability-cryptocurrency/Press/Media Coverage, Third Party Advisory
• https://github.com/JinBean/CVE-Extension
• https://z.cash/blog/zcash-counterfeiting-vulnerability-successfully-remediated/Vendor Advisory
• http://fortune.com/2019/02/05/zcash-vulnerability-cryptocurrency/Press/Media Coverage, Third Party Advisory
• https://github.com/JinBean/CVE-Extension
• https://z.cash/blog/zcash-counterfeiting-vulnerability-successfully-remediated/Vendor Advisory

Published

Mar 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7160idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Dire…
• CVE-2019-7161An issue was discovered in Zoho ManageEngine ADSelfService P…
• CVE-2019-7162An issue was discovered in Zoho ManageEngine ADSelfService P…9.1
• CVE-2019-7163The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40_LU_02…
• CVE-2019-7164SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows S…9.8
• CVE-2019-7165A buffer overflow in DOSBox 0.74-2 allows attackers to execu…
• CVE-2019-7168A stored-self XSS exists in Croogo through v3.0.5, allowing …
• CVE-2019-7169A stored-self XSS exists in Croogo through v3.0.5, allowing …
• CVE-2019-7170A stored-self XSS exists in Croogo through v3.0.5, allowing …
• CVE-2019-7171A stored-self XSS exists in Croogo through v3.0.5, allowing …
• CVE-2019-7172A stored-self XSS exists in ATutor through v2.2.4, allowing …
• CVE-2019-7173A stored-self XSS exists in Croogo through v3.0.5, allowing …