Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-86840: Bifrost can misdirect commission payouts to chosen channel
CVE-2026-86840 · published 1 month ago
Summary
Two components of Bifrost that create new tokens can be tricked into accepting any channel identifier, even one the caller does not control. This lets a malicious user inflate a channel’s reported mint activity and receive a larger share of commission payments. Apply the latest update from the vendor and check commission reports for unexpected amounts.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| bitfrost.io | bifrost | <= 2022.02 |
Original advisory text
Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion
The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-862Missing Authorization
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published8 Sep 2026
Updated11 Oct 2026
First seen8 Sep 2026
Track software like this
Free during beta