CVE-2026-61604
ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
Type: Improper authorization leading to unauthorized movement of user funds.
- No known exploitation
- Severity
- Critical, CVSS 9.3 (v4.0)
- EPSS
- 0.27% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- github.com/ixofoundation/ixo-blockchain/v8 (go) < 8.0.0, fixed in 8.0.0 · GHSA-w3rp-4cm2-4wgc
- github.com/ixofoundation/ixo-blockchain/v7 (go) <= 7.0.0, no fix yet · GHSA-w3rp-4cm2-4wgc
- github.com/ixofoundation/ixo-blockchain/v6 (go) <= 6.0.1, no fix yet · GHSA-w3rp-4cm2-4wgc
- github.com/ixofoundation/ixo-blockchain/v5 (go) <= 5.0.0, no fix yet · GHSA-w3rp-4cm2-4wgc
- github.com/ixofoundation/ixo-blockchain/v4 (go) <= 4.0.0, no fix yet · GHSA-w3rp-4cm2-4wgc
- github.com/ixofoundation/ixo-blockchain/v3 (go) <= 3.0.0, no fix yet · GHSA-w3rp-4cm2-4wgc
- github.com/ixofoundation/ixo-blockchain (go) <= 1.6.0, no fix yet · GHSA-w3rp-4cm2-4wgc