🔺Severity: High
👽 Reporter: benisprlh
⭐️ Reputation: 139
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-21
⏰ Disclosed: 2026-08-05 05:05:59
📝 Summary: The
set daemon JSON-RPC in monero-wallet-rpc was found to have a vulnerability that silently ignored the ssl allowed fingerprints parameter, allowing MITM attacks against the wallet-daemon connection. The vulnerability was introduced in the initial release of the RPC in March 2019 and affected all subsequent versions up to the latest release. The vulnerability was caused by improper handling of the fingerprint list, where the fingerprints were stored as ASCII characters instead of the expected raw SHA-256 digest. This resulted in the verification check always failing, and the connection being accepted by default when ssl support was set to "autodetect".📂 Report JSON File: 3686259
@hackeronereports