klever-io Klever-Go up to 1.7.19 Marketplace market.go Buy IsClaimed input validation

Summaryinfo

A vulnerability was found in klever-io Klever-Go up to 1.7.19. It has been rated as problematic. The impacted element is the function Buy of the file core/kapp/market/market.go of the component Marketplace. Performing a manipulation of the argument IsClaimed results in input validation. This vulnerability is known as CVE-2026-82406. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in klever-io Klever-Go up to 1.7.19. This affects the function Buy of the file core/kapp/market/market.go of the component Marketplace. The manipulation of the argument IsClaimed with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on integrity. The summary by CVE is:

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-82406 since 08/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

Upgrading to version 1.7.20 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• klever-io

Name

• Klever-Go

Version

• 1.7.0
• 1.7.1
• 1.7.2
• 1.7.3
• 1.7.4
• 1.7.5
• 1.7.6
• 1.7.7
• 1.7.8
• 1.7.9
• 1.7.10
• 1.7.11
• 1.7.12
• 1.7.13
• 1.7.14
• 1.7.15
• 1.7.16
• 1.7.17
• 1.7.18
• 1.7.19

Website

• Product: https://github.com/klever-io/klever-go/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion