CVE-2026-82406

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.

• CWE-841

• https://github.com/klever-io/klever-go/commit/063bb3ed98f9a84a4b1f7286680613a5fc3c91b2
• https://github.com/klever-io/klever-go/pull/16
• https://github.com/klever-io/klever-go/releases/tag/v1.7.20
• https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c

Published

Sep 23, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82397Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2026-82398pypdf is a free and open-source pure-python PDF library. Pri…6.9
• CVE-2026-82399CoreDNS is a DNS server written in Go. Prior to 1.14.7, the …7.5
• CVE-2026-8240Concrete CMS 9.5.0 and below is vulnerable to unauthenticate…5.3
• CVE-2026-82404TOON is a compact, human-readable serialization of JSON data…8.3
• CVE-2026-82405Klever-Go is the Go implementation of the Klever blockchain …8.7
• CVE-2026-82407Klever-Go is the Go implementation of the Klever blockchain …7
• CVE-2026-82409Klever-Go is the Go implementation of the Klever blockchain …8.4
• CVE-2026-8241A vulnerability has been found in Industrial Application Sof…5.5
• CVE-2026-82410Pocketbase is an open source web backend written in go. Prio…8.7
• CVE-2026-82412ntopng is a web-based network traffic monitoring application…8.8
• CVE-2026-82417### Summary `qs.stringify` throws a `TypeError` when it s…5.3