GHSA-wfm2-rq5g-f8v5: @account-kit/smart-contracts Allowlist Module Bypass Vulnerability

April 29, 2025 (updated October 31, 2025)

Allowlist module contains a bypass vulnerability

References

github.com/advisories/GHSA-wfm2-rq5g-f8v5
github.com/alchemyplatform/aa-sdk
github.com/alchemyplatform/aa-sdk/commit/b65bafdb9eec3a009df2cbabf09a35a76550e9d0
github.com/alchemyplatform/aa-sdk/security/advisories/GHSA-wfm2-rq5g-f8v5

Code Behaviors & Features

Detect and mitigate GHSA-wfm2-rq5g-f8v5 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →