CVE-2024-1631 | agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`

Exp

Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using secure randomness. However, a recent change broke this guarantee and uses an insecure seed for key pair generation. Since the private key of this identity (535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe) is compromised, one could lose funds associated with the principal on ledgers or lose access to a canister where this principal is the controller.

Published: 2024-02-21 Last update: 2025-12-10 Assigner: 6b35d637-e00f-4228-858c-b20ad6e1d07b Source: 6b35d637-e00f-4228-858c-b20ad6e1d07b
NVD Status：Analyzed，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2024-1631 is rated High Exploit Risk (80.6/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 1.74%). 1 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2024-1631

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2024-1631

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-03-11 1.33% 1.74% +0.40%
2 2026-03-08 0.44% 1.33% +0.90%
3 2025-12-18 — 0.44% —

Full EPSS history (11 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2024-1631

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
9.1 3.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N)
Service keeps running; no real outage angle.
 3.9 5.2 6b35d637-e00f-4228-858c-b20ad6e1d07b

Weakness enumeration for CVE-2024-1631

GitHub Security Advisory for CVE-2024-1631

GHSA-c9vv-fhgv-cjc3 · Severity: critical · Ecosystem: npm — agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`

Affected software / configurations for CVE-2024-1631

Vendor Product Version Raw CPE
dfinity icp-js-core >= 0.20.0, < 1.0.1 cpe:2.3:a:dfinity:icp-js-core:*:*:*:*:*:node.js:*:*

References for CVE-2024-1631

cvelogic Threat Intelligence