{"id":"CVE-2026-86840","title":"The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution","summary":"The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying …","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-639","CWE-862"],"vendor":"Bitfrost.io","product":"Bifrost","affected":["Bifrost <= 2022.02"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T19:17:36.980","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86840","references":[{"url":"https://docs.bifrost.io/faq/what-are-vtokens","label":"cret@cert.org"},{"url":"https://gist.github.com/prasanna8585/ffd112b1a125ca4c5533fdce45ef57c1","label":"cret@cert.org"},{"url":"https://gist.github.com/prasanna8585/ffd112b1a125ca4c5533fdce45ef57c1","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-10T18:26:55.960946Z"},"epss":0.00241,"epssPercentile":0.15552,"ingestedAt":"2026-09-08T16:34:19.229Z","slug":"CVE-2026-86840","body":"## Overview\n\nThe `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":62,"depthScoreParts":{"impact":50.1,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":202157,"id":"CVE-2026-86840","ts":1789400064568,"field":"exploit_available","old":"false","new":"true"},{"seq":202156,"id":"CVE-2026-86840","ts":1789400064568,"field":"cvss","old":null,"new":"9.1"},{"seq":202155,"id":"CVE-2026-86840","ts":1789400064568,"field":"severity","old":"none","new":"critical"},{"seq":200884,"id":"CVE-2026-86840","ts":1789397618156,"field":"exploit_available","old":"true","new":"false"},{"seq":200883,"id":"CVE-2026-86840","ts":1789397618156,"field":"cvss","old":"9.1","new":null},{"seq":200882,"id":"CVE-2026-86840","ts":1789397618156,"field":"severity","old":"critical","new":"none"},{"seq":199577,"id":"CVE-2026-86840","ts":1789395552820,"field":"exploit_available","old":"false","new":"true"},{"seq":199576,"id":"CVE-2026-86840","ts":1789395552820,"field":"cvss","old":null,"new":"9.1"},{"seq":199575,"id":"CVE-2026-86840","ts":1789395552820,"field":"severity","old":"none","new":"critical"},{"seq":198822,"id":"CVE-2026-86840","ts":1789392246092,"field":"exploit_available","old":"true","new":"false"},{"seq":198821,"id":"CVE-2026-86840","ts":1789392246092,"field":"cvss","old":"9.1","new":null},{"seq":198820,"id":"CVE-2026-86840","ts":1789392246092,"field":"severity","old":"critical","new":"none"},{"seq":197155,"id":"CVE-2026-86840","ts":1789384295629,"field":"exploit_available","old":"false","new":"true"},{"seq":197154,"id":"CVE-2026-86840","ts":1789384295629,"field":"cvss","old":null,"new":"9.1"},{"seq":197153,"id":"CVE-2026-86840","ts":1789384295629,"field":"severity","old":"none","new":"critical"},{"seq":196429,"id":"CVE-2026-86840","ts":1789383757651,"field":"exploit_available","old":"true","new":"false"},{"seq":196428,"id":"CVE-2026-86840","ts":1789383757651,"field":"cvss","old":"9.1","new":null},{"seq":196427,"id":"CVE-2026-86840","ts":1789383757651,"field":"severity","old":"critical","new":"none"},{"seq":195333,"id":"CVE-2026-86840","ts":1789380576378,"field":"exploit_available","old":"false","new":"true"},{"seq":195332,"id":"CVE-2026-86840","ts":1789380576378,"field":"cvss","old":null,"new":"9.1"},{"seq":195331,"id":"CVE-2026-86840","ts":1789380576378,"field":"severity","old":"none","new":"critical"},{"seq":194284,"id":"CVE-2026-86840","ts":1789378784805,"field":"exploit_available","old":"true","new":"false"},{"seq":194283,"id":"CVE-2026-86840","ts":1789378784805,"field":"cvss","old":"9.1","new":null},{"seq":194282,"id":"CVE-2026-86840","ts":1789378784805,"field":"severity","old":"critical","new":"none"},{"seq":193071,"id":"CVE-2026-86840","ts":1789376519528,"field":"exploit_available","old":"false","new":"true"},{"seq":193070,"id":"CVE-2026-86840","ts":1789376519528,"field":"cvss","old":null,"new":"9.1"},{"seq":193069,"id":"CVE-2026-86840","ts":1789376519528,"field":"severity","old":"none","new":"critical"},{"seq":191858,"id":"CVE-2026-86840","ts":1789373633053,"field":"exploit_available","old":"true","new":"false"},{"seq":191857,"id":"CVE-2026-86840","ts":1789373633053,"field":"cvss","old":"9.1","new":null},{"seq":191856,"id":"CVE-2026-86840","ts":1789373633053,"field":"severity","old":"critical","new":"none"},{"seq":190643,"id":"CVE-2026-86840","ts":1789369486001,"field":"exploit_available","old":"false","new":"true"},{"seq":190642,"id":"CVE-2026-86840","ts":1789369486001,"field":"cvss","old":null,"new":"9.1"},{"seq":190641,"id":"CVE-2026-86840","ts":1789369486001,"field":"severity","old":"none","new":"critical"},{"seq":189430,"id":"CVE-2026-86840","ts":1789368447605,"field":"exploit_available","old":"true","new":"false"},{"seq":189429,"id":"CVE-2026-86840","ts":1789368447605,"field":"cvss","old":"9.1","new":null},{"seq":189428,"id":"CVE-2026-86840","ts":1789368447605,"field":"severity","old":"critical","new":"none"},{"seq":188213,"id":"CVE-2026-86840","ts":1789365235505,"field":"exploit_available","old":"false","new":"true"},{"seq":188212,"id":"CVE-2026-86840","ts":1789365235505,"field":"cvss","old":null,"new":"9.1"},{"seq":188211,"id":"CVE-2026-86840","ts":1789365235505,"field":"severity","old":"none","new":"critical"},{"seq":187000,"id":"CVE-2026-86840","ts":1789363472908,"field":"exploit_available","old":"true","new":"false"},{"seq":186999,"id":"CVE-2026-86840","ts":1789363472908,"field":"cvss","old":"9.1","new":null},{"seq":186998,"id":"CVE-2026-86840","ts":1789363472908,"field":"severity","old":"critical","new":"none"},{"seq":185786,"id":"CVE-2026-86840","ts":1789361234140,"field":"exploit_available","old":"false","new":"true"},{"seq":185785,"id":"CVE-2026-86840","ts":1789361234140,"field":"cvss","old":null,"new":"9.1"},{"seq":185784,"id":"CVE-2026-86840","ts":1789361234140,"field":"severity","old":"none","new":"critical"},{"seq":184573,"id":"CVE-2026-86840","ts":1789358365550,"field":"exploit_available","old":"true","new":"false"},{"seq":184572,"id":"CVE-2026-86840","ts":1789358365550,"field":"cvss","old":"9.1","new":null},{"seq":184571,"id":"CVE-2026-86840","ts":1789358365550,"field":"severity","old":"critical","new":"none"},{"seq":182823,"id":"CVE-2026-86840","ts":1789354321827,"field":"exploit_available","old":"false","new":"true"},{"seq":182822,"id":"CVE-2026-86840","ts":1789354321827,"field":"cvss","old":null,"new":"9.1"}]}