The vulnerability in nimiq-block versions before 1.3.0 arises from improper input validation in the SkipBlockProof::verify method. The method calculates quorum using BitSet.len() and casts usize indices to u16 for slot lookup. Attackers can supply MultiSignature.signers with out-of-range indices spaced by 65536, inflating the length count but causing collisions on the same u16 slot during aggregation. This flaw enables a malicious validator to appear as if it has the required 2f+1 signer slots by effectively multiplying a single BLS signature, thus bypassing the quorum check. The issue is fixed in nimiq-block v1.3.0. No mitigations other than upgrading are known.

This vulnerability allows an attacker controlling a malicious validator to bypass the quorum verification in skip block proofs, potentially compromising the integrity of the consensus process. It does not affect confidentiality but can lead to invalid blocks being accepted, impacting system availability and trustworthiness. The CVSS 3.1 score of 9.6 reflects critical severity with network attack vector, low attack complexity, and partial privileges required.

Upgrade to nimiq-block version 1.3.0 or later, which includes the official fix for this vulnerability. No other workarounds or mitigations are available. Users should apply this patch promptly to prevent exploitation.