CVE-2023-23940

OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.

• CWE-345
• CWE-347
• CWE-347

• https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2fd916f73297632f899aca9299Patch, Third Party Advisory
• https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-626q-v9j4-mcp4Third Party Advisory
• https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2fd916f73297632f899aca9299Patch, Third Party Advisory
• https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-626q-v9j4-mcp4Third Party Advisory

Published

Feb 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23935Discourse is an open-source messaging platform. In versions …4.3
• CVE-2023-23936Undici is an HTTP/1.1 client for Node.js. Starting with vers…5.4
• CVE-2023-23937Pimcore is an Open Source Data & Experience Management Platf…5.4
• CVE-2023-23938Tuleap is a Free & Source tool for end to end traceability o…4.8
• CVE-2023-23939Azure/setup-kubectl is a GitHub Action for installing Kubect…7
• CVE-2023-2394A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. …4.8
• CVE-2023-23941SwagPayPal is a PayPal integration for shopware/platform. If…7.5
• CVE-2023-23942The Nextcloud Desktop Client is a tool to synchronize files …6.1
• CVE-2023-23943Nextcloud mail is an email app for the nextcloud home server…4.3
• CVE-2023-23944Nextcloud mail is an email app for the nextcloud home server…6.5
• CVE-2023-23946Git, a revision control system, is vulnerable to path traver…7.5
• CVE-2023-23947Argo CD is a declarative, GitOps continuous delivery tool fo…8.5