CVE-2026-46369

Received Received - Intake

Remote Transaction Replay in Nimiq Proof-of-Stake

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_valid_at, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender and recipient balances to be updated twice. This issue is fixed in version 1.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-46369

Affected Vendors & Products

Vendor	Product	Version / Range
nimiq	nimiq	1.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-193	A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

This vulnerability in Nimiq's Rust implementation allows an attacker to replay a signed transaction multiple times within a specific block window. The validity store incorrectly expires transactions too early, enabling the attacker to cause sender and recipient balances to be updated twice for the same transaction.

Detection Guidance

This vulnerability can be detected by checking the Nimiq software version in use. If your system runs Nimiq version 1.5.0 or earlier, it is vulnerable. Run the command 'nimiq --version' to check the installed version.

Impact Analysis

If exploited, this vulnerability could lead to financial losses by allowing duplicate balance updates for the same transaction. Users may experience incorrect account balances or unauthorized fund transfers.

Compliance Impact

The vulnerability allows replay attacks where signed transactions are processed multiple times, potentially leading to incorrect balance updates. This could result in financial discrepancies or unauthorized transactions, which may violate compliance requirements for data integrity and auditability in standards like GDPR or HIPAA.

Mitigation Strategies

Immediately upgrade Nimiq to version 1.5.1 or later to patch the vulnerability. Follow the official Nimiq update instructions to ensure a secure installation.

Hi! I’m here to help you understand CVE-2026-46369. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70