CVE-2024-1631

Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using secure randomness. However, a recent change broke this guarantee and uses an insecure seed for key pair generation. Since the private key of this identity (535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe) is compromised, one could lose funds associated with the principal on ledgers or lose access to a canister where this principal is the controller.

• CWE-321
• CWE-330
• CWE-330

• https://agent-js.icp.xyz/identity/index.htmlBroken Link
• https://github.com/dfinity/agent-jsProduct
• https://github.com/dfinity/agent-js/pull/851Issue Tracking, Patch
• https://github.com/dfinity/agent-js/security/advisories/GHSA-c9vv-fhgv-cjc3Exploit, Vendor Advisory
• https://www.npmjs.com/package/@dfinity/identity/v/1.0.1Product
• https://agent-js.icp.xyz/identity/index.htmlBroken Link
• https://github.com/dfinity/agent-jsProduct
• https://github.com/dfinity/agent-js/pull/851Issue Tracking, Patch
• https://github.com/dfinity/agent-js/security/advisories/GHSA-c9vv-fhgv-cjc3Exploit, Vendor Advisory
• https://www.npmjs.com/package/@dfinity/identity/v/1.0.1Product

Published

Feb 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-1624An OS Command Injection vulnerability affecting documentatio…9.4
• CVE-2024-1625An Insecure Direct Object Reference (IDOR) vulnerability exi…6.5
• CVE-2024-1626An Insecure Direct Object Reference (IDOR) vulnerability exi…8.1
• CVE-2024-1628OS command injection vulnerabilities in GE HealthCare ultras…8.4
• CVE-2024-1629Path traversal vulnerability in “deleteFiles” function of Co…6.2
• CVE-2024-1630Path traversal vulnerability in “getAllFolderContents” funct…7.7
• CVE-2024-1632Low-privileged users with access to the Sitefinity backend m…6.5
• CVE-2024-1633During the secure boot, bl2 (the second stage of the bootloa…2
• CVE-2024-1634The Scheduling Plugin – Online Booking for WordPress plugin …6.5
• CVE-2024-1635A vulnerability was found in Undertow. This vulnerability im…7.5
• CVE-2024-1636Potential Cross-Site Scripting (XSS) in the page editing are…5.4
• CVE-2024-1637The 360 Javascript Viewer plugin for WordPress is vulnerable…4.3