RUSTSEC-2026-0334: BIP-322 Address Ownership Verification Bypass in bip322

Vulnerability Overview RUSTSEC-2026-0334 Title: BIP-322 Address Ownership Verification Bypass Affects P2WPKH and P2SH-P2WPKH Addresses Report Date: August 14, 2026 Publish Date: October 9, 2026 Package: (crates.io) Type: Vulnerability Category: Cryptographic Failure Keywords: #bip322 #bitcoin #signature-verification Alias: GHSA-5chw-87w3-j9cv Reference Link: GitHub Commit CVSS Score: 9.1 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Scope Affected Functions: - - - - Affected Versions: >=0.0.6, =0.0.11 Fix Description: - In commit , the vulnerability is fixed by extracting the expected from the witness (for P2WPKH, it is ; for P2SH, it is the nested case) and verifying that it matches the of the claimed address. - If the match fails, it returns . - The fix is included in version 0.0.11. - Affected versions 0.0.6 through 0.0.10 have been yanked (removed) from crates.io. Description Affected versions of accept a BIP-322 proof created with an attacker-controlled private key as a valid signature for unrelated victim P2WPKH or P2SH-P2WPKH addresses. This allows for complete authentication bypass when using , , , or within applications. In , the verifier retrieves the public key from a caller-controlled witness and passes it to , where the so-called public key mismatch check reads the key from the same witness and compares it. This comparison is redundant since was originally parsed from the exact witness element. The code verifies that the signature is valid for the public key embedded in the witness, but it never verifies that this public key hashes to the claimed address, violating the BIP-322 requirement that must satisfy (the of the claimed address). Consequently, an attacker can choose any victim P2WPKH or P2SH-P2WPKH address, construct a BIP-322 challenge using that address and message, sign it with their own unrelated private key, and have the proof accepted. This requires no victim key or victim interaction. Application-level nonces (nonces generated by the application) will not mitigate this issue because the attacker can construct and sign the current challenge message. P2TR verification is not affected: the public key is derived from the address's witness program, not from a caller-controlled witness. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

RUSTSEC-2026-0334: BIP-322 Address Ownership Verification Bypass in bip322