- Reported
-
- Issued
-
- Package
-
nostr
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#nostr
#nip46
#nip60
#credentials
- References
-
- CVSS Score
- 5.5
MEDIUM
- CVSS Details
-
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality Impact
- High
- Integrity Impact
- None
- Availability Impact
- None
- CVSS Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Patched
-
Description
Several NIP-46 and NIP-60 types used derived Debug implementations even though
their fields contained credentials or decrypted application data. Formatting these
values exposed NIP-46 connection secrets and request parameters, as well as NIP-60
private keys, Cashu bearer proofs, and quote capability identifiers.
Applications commonly include Debug output in diagnostic logs, tracing spans, or
error reports. Anyone able to read those outputs could recover the disclosed
credentials and, depending on the value, impersonate a signer connection or spend
wallet tokens. The issue does not expose data unless an affected value is formatted
and the resulting output is made accessible.
The affected types now use custom Debug implementations that preserve variant and
non-sensitive structural information while replacing credentials, bearer values,
and plaintext fields with redaction markers. Serialization and protocol behavior are
unchanged.
Advisory available under CC0-1.0
license.