CVE-2026-46669

7.5 HIGH

OpenVM is a performant and modular zkVM framework built for customization and extensibility

Published: 2026-06-10 · Last updated: 2026-06-12

Severity and scoring

CVSS: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE: CWE-20

Affected products

Vendor	Product
openvm	openvm

Description

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_honest_pairing_check function invokes Theorem 3 of https://eprint.iacr.org/2024/640.pdf but does not check that the scaling factor s is in a proper subfield of Fp12. This allows incorrect results to the pairing check. This issue has been patched in version 1.6.0.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-46669
[Other]https://github.com/openvm-org/openvm/releases/tag/v1.6.0
[Vendor advisory]https://github.com/openvm-org/openvm/security/advisories/GHSA-76mq-v757-53gr
[Vendor advisory]https://github.com/openvm-org/openvm/security/advisories/GHSA-76mq-v757-53gr

Related CVEs

Same CWE

CVE-2026-45013 — ApostropheCMS is an open-source Node.js content management system (8.1 HIGH)
CVE-2026-54133 — jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP app... (9.8 CRITICAL)
CVE-2026-47196 — Quest Bot is an opensource Discord Bot
CVE-2026-50633 — A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an atta... (8.1 HIGH)
CVE-2026-50632 — A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been ide... (8.1 HIGH)