CVE-2021-25834: Authentication bypass by capture-replay in github.com/cosmos/ethermint
Summary
CVE-2021-25834: Authentication bypass by capture-replay in github.com/cosmos/ethermint. Affects github.com/cosmos/ethermint versions < 0.4.1. Fixed in 0.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/cosmos/ethermint package is a Go package that provides functionality for Ethermint, a scalable and interoperable Ethereum implementation built on the Cosmos SDK. Ethermint enables developers to build decentralized applications (dApps) on top of the Cosmos network. It includes features such as smart contracts, token issuance, and transaction processing.
Vulnerability Detail
This vulnerability in github.com/cosmos/ethermint allows for authentication bypass through a capture-replay attack. An attacker can intercept and replay authentication credentials, gaining unauthorized access to the system. This can lead to various security risks, including unauthorized data access, privilege escalation, and potential manipulation of the blockchain network.
How To Fix
Latest published version: v0.4.1 as of 23 Oct 2026
go get github.com/cosmos/ethermint@v0.4.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.1
This is the first release that contains the fix.
go get github.com/cosmos/ethermint@v0.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of github.com/cosmos/ethermint to mitigate the risk of authentication bypass.
Conclusion
The authentication bypass vulnerability in github.com/cosmos/ethermint can be mitigated by updating to version 0.4.1 or later. It is crucial to promptly apply this fix to prevent unauthorized access and potential manipulation of the blockchain network.
See every vulnerability recorded for github.com/cosmos/ethermint →
FAQ
github.com/cosmos/ethermint is a Go package that provides an Ethereum implementation on the Cosmos network, allowing developers to build decentralized applications.
This vulnerability allows for authentication bypass, potentially leading to unauthorized access, data breaches, and manipulation of the blockchain network.
To fix this vulnerability, update to version 0.4.1 or later of github.com/cosmos/ethermint, which includes a patch to prevent capture-replay attacks.
There are no known workarounds for this vulnerability. It is essential to update to the fixed version of github.com/cosmos/ethermint.
You can find more information about this vulnerability in the vulnerability report at https://pkg.go.dev/vuln/GO-2022-0813.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cosmos/ethermint.
