Threats affecting pkg:github/nimiq/nimiq-transaction

A vulnerability in nimiq-transaction prior to version 1.3.0 allows improper verification of cryptographic signatures in the staking contract's UpdateValidator transactions. Specifically, the contract accepts transactions that set a new voting key without requiring the associated proof of knowledge, enabling a potential BLS rogue-key attack. This flaw could allow an attacker to forge a quorum-looking justification by producing only a single signature due to aggregated BLS signature verification. The vulnerability has a medium severity with a CVSS score of 6.8. Exploitation is considered low likelihood because the attacker would need knowledge of the next epoch validator set, which is chosen unpredictably. The issue is fixed in version 1.3.