CVE-2026-82406 Details
Description
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.
A vulnerability exists in Klever-Go's native marketplace function 'Buy' in versions prior to 1.7.20. The 'Buy' function fails to check if an order has been claimed before accepting bids. This oversight allows sellers to prematurely claim orders in resting-bid auctions, creating 'zombie' orders that appear live but are already settled. Later bidders can unknowingly bid on these orders, leading to a loss of funds and NFTs. The issue is exacerbated by the fact that the 'Claim' and 'CancelOrder' functions properly enforce the claimed order check, leaving victims with no recovery options.
The vulnerability has been fixed in Klever-Go version 1.7.20. Users should update to this version and ensure that their node configuration activates the 'fixAuditChangesV3' flag at the appropriate epoch to maintain consensus.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/klever-io/klever-go/commit/063bb3ed98f9a84a4b1f7286680613a5fc3c91b2 | [email protected] | Source CodeVendor |
| https://github.com/klever-io/klever-go/pull/16 | [email protected] | Issue TrackingVendor |
| https://github.com/klever-io/klever-go/releases/tag/v1.7.20 | [email protected] | Release NotesVendor |
| https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-841 | Improper Enforcement of Behavioral Workflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Klever-Go | <= v1.7.19 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |