CVE-2026-82406: Klever-Go Authentication Bypass Vulnerability

CVE-2026-82406 Overview

CVE-2026-82406 affects Klever-Go, the Go implementation of the Klever blockchain protocol. The vulnerability resides in the native marketplace function Buy within core/kapp/market/market.go. Prior to version 1.7.20, the function does not verify the IsClaimed flag before accepting a bid on a marketplace order. This gap enables a business logic flaw where a settled auction can continue to accept bids, causing later bidders to lose funds without receiving the NFT. The issue is classified under [CWE-841: Improper Enforcement of Behavioral Workflow] and is fixed in Klever-Go version 1.7.20.

Critical Impact
Later bidders on already-claimed marketplace orders are debited funds and cannot obtain the NFT or recover their funds through Claim or CancelOrder, resulting in financial loss on-chain.

Affected Products

Klever-Go blockchain node implementation
Klever-Go versions prior to 1.7.20
Klever native marketplace module (core/kapp/market)

Discovery Timeline

2026-09-23 - CVE-2026-82406 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-82406

Vulnerability Analysis

The flaw is a workflow enforcement failure in the Klever-Go marketplace contract. When a seller invokes the Claim seller-accept branch to settle a resting-bid auction, the underlying order is marked as claimed. However, the order record retains a future EndTime along with stale CurrentBid and CurrentBidder values. The order therefore continues to appear live to callers and remains loadable through the Buy code path.

A subsequent bidder can submit a higher bid on this zombie order. The Buy function debits the new bidder and refunds the previous bidder, even though the NFT has already been delivered to the original winner. Because Claim and CancelOrder both reject callers when IsClaimed is true, the newest bidder cannot claim the NFT and cannot cancel to recover their funds.

Root Cause

The Buy handler in core/kapp/market/market.go lacked an IsClaimed guard that was already present in the Claim and CancelOrder handlers. Marking an order as claimed in the seller-accept flow did not invalidate the order for the bidding path, producing inconsistent state between the three handlers.

Attack Vector

The vulnerability is exploited over the network by any authenticated account that can submit a marketplace transaction. An attacker with a low-privilege blockchain account monitors auctions settled through the Claim seller-accept branch, then races to submit a Buy transaction against the still-live-looking order. The attacker is not the beneficiary here; instead, arbitrary users can be tricked or front-run into losing funds on claimed orders. The result is loss of integrity for marketplace state and user balances.

// Source: https://github.com/klever-io/klever-go/commit/063bb3ed98f9a84a4b1f7286680613a5fc3c91b2
// Patch in core/kapp/market/market.go - Buy handler
		return transaction.Transaction_ParameterInvalid, err
	}

	// Reject bids on an already-settled (claimed) order, mirroring the IsClaimed
	// guards in Claim and CancelOrder. Early seller-accept in Claim marks the order
	// claimed but leaves EndTime in the future, so a "zombie" order still reads as
	// live and would strand a later bidder (GHSA-26r5-4mm2-px5c). Gated on
	// FixAuditChangesV3: turning a successful Buy into a rejection is
	// consensus-visible and must activate at a future epoch to stay replay-safe.
	if m.forkController.FixAuditChangesV3() && marketOrder.IsClaimed {
		ctx.Receipts().AddError(ctx.ContractID(), common.ErrFieldInvalidOrder, common.ErrInvalidValue.Error())
		return transaction.Transaction_ParameterInvalid, common.ErrInvalidValue
	}

	if !bytes.Equal(marketOrder.CurrencyID, currencyID) {
		ctx.Receipts().AddError(ctx.ContractID(), common.ErrFieldOrderCurrencyInvalid, common.ErrInvalidValue.Error())
		return transaction.Transaction_ParameterInvalid, common.ErrInvalidValue

The patch adds an IsClaimed check gated behind the FixAuditChangesV3 fork flag, ensuring the state change activates at a future epoch and remains replay-safe across the network. See the GitHub Security Advisory GHSA-26r5-4mm2-px5c for full details.

Detection Methods for CVE-2026-82406

Indicators of Compromise

Successful Buy transactions targeting marketplace orders whose IsClaimed field is already true.
Marketplace orders exhibiting a future EndTime alongside a non-zero IsClaimed state.
Refund transactions to prior bidders occurring after a seller-accept Claim on the same order ID.

Detection Strategies

Replay marketplace transactions against pre-patch state and flag any Buy accepted after a Claim seller-accept branch on the same order.
Correlate Claim events with subsequent Buy events sharing the same order identifier within the auction window.
Monitor validator logs for divergence between nodes running versions before and after 1.7.20 once FixAuditChangesV3 activates.

Monitoring Recommendations

Track NFT ownership transfers against marketplace order state to detect NFTs delivered while the order still accepts bids.
Alert on user support reports of debited balances without NFT receipt on Klever-Go marketplace orders.
Ingest node telemetry into a centralized data lake and pivot on marketplace contract IDs for anomalous state transitions.

How to Mitigate CVE-2026-82406

Immediate Actions Required

Upgrade all Klever-Go nodes and integrators to version 1.7.20 or later before the FixAuditChangesV3 fork epoch.
Audit historical marketplace transactions for Buy calls executed against orders with IsClaimed set to true and identify affected users.
Coordinate with validators to ensure a consistent upgrade window and prevent consensus divergence.

Patch Information

The fix is available in the GitHub Release v1.7.20. The corresponding change is tracked in GitHub Pull Request #16 and applied in the GitHub Commit 063bb3e. The patch adds an IsClaimed guard to the Buy handler in core/kapp/market/market.go, gated behind the FixAuditChangesV3 fork flag to preserve replay safety.

Workarounds

No supported code-level workaround exists prior to upgrading to 1.7.20; the fix must activate at a fork epoch to remain consensus-safe.
Front-end marketplace clients should refuse to display or submit Buy transactions for orders whose IsClaimed flag is true.
Wallet integrators should validate order state through a read-only query before broadcasting any Buy transaction to reduce exposure.

bash

# Upgrade Klever-Go node to the patched release
git clone https://github.com/klever-io/klever-go.git
cd klever-go
git checkout v1.7.20
make build