CVE-2026-56744

Deferred Deferred - Pending Action

Unverified Output Script Trust in BSV Wallet Toolbox

Publication date: 2026-09-24

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

`@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, while `@bsv/wallet-toolbox-client` and `@bsv/wallet-toolbox-mobile` provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transactions created through a remote `StorageClient` to trust output locking scripts returned by the storage provider without verifying that they match the outputs requested by the caller. A malicious or compromised storage provider can substitute a recipient script or inject an additional output, causing the wallet to sign and broadcast a transaction that redirects funds while the application and user interface continue to display the intended recipient. Source and npm publication history indicate that stable versions `@bsv/wallet-toolbox` and `@bsv/wallet-toolbox-client` from 1.1.47 through 2.3.3, and `@bsv/wallet-toolbox-mobile` from its initial 1.3.21 release through 2.3.3, are affected. All three packages are patched in version 2.4.0. Applications unable to upgrade should avoid remote `StorageClient` providers, use local storage, or independently verify every transaction output’s locking script and value against the original request before signing

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-30

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-56744

EUVD

EUVD-2026-86301

Affected Vendors & Products

Vendor	Product	Version / Range
bsv	wallet-toolbox	From 1.1.47 (inc) to 2.3.3 (inc)
bsv	wallet-toolbox-client	From 1.1.47 (inc) to 2.3.3 (inc)
bsv	wallet-toolbox-mobile	From 1.3.21 (inc) to 2.3.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1288	The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.

Attack-Flow Graph

Executive Summary

This vulnerability affects BSV wallet-toolbox packages (@bsv/wallet-toolbox, @bsv/wallet-toolbox-client, @bsv/wallet-toolbox-mobile) versions 1.1.47 through 2.3.3. It allows a malicious or compromised remote storage provider to alter transaction outputs without user knowledge. The wallet signs transactions using output scripts provided by storage without verifying they match the user's requested outputs. This could redirect funds to unintended recipients while the UI still shows the original recipient.

Detection Guidance

This vulnerability involves improper output verification in wallet-toolbox packages. To detect it, check if your application uses @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, or @bsv/wallet-toolbox-mobile versions between 1.1.47-2.3.3 (or 1.3.21-2.3.3 for mobile). Run: npm list @bsv/wallet-toolbox @bsv/wallet-toolbox-client @bsv/wallet-toolbox-mobile. If affected versions are installed, the vulnerability exists.

Impact Analysis

If you use affected wallet-toolbox versions with remote storage, an attacker controlling the storage provider could redirect your payments to their address. Your wallet would sign and broadcast the altered transaction while displaying the original recipient in the UI. This could result in loss of funds to unintended recipients without your awareness.

Compliance Impact

This vulnerability could lead to unauthorized fund transfers, which may violate financial regulations requiring transaction integrity and user consent. For GDPR, it risks unauthorized data processing (fund transfers) without proper authorization. For HIPAA, if misused in healthcare payment systems, it could compromise financial transaction security.

Mitigation Strategies

Upgrade all affected packages to version 2.4.0 or later using: npm update @bsv/wallet-toolbox @bsv/wallet-toolbox-client @bsv/wallet-toolbox-mobile. If upgrading isn't possible, avoid remote StorageClient providers and use local storage instead. Always verify transaction outputs independently before signing.

Hi! I’m here to help you understand CVE-2026-56744. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70