CVE-2023-50053

Foundation platform 1.0's Web3 authentication signs a message that lacks a nonce — no random, single-use value binding the signature to one specific login attempt. Without that, a signature an attacker can capture or induce is replayable: the same signed message can be presented again to authenticate, because nothing ties it to a fresh challenge. The result is a sensitive-information and authentication weakness in the sign-in flow rather than a server break-in.

This is a design flaw in a specific Web3 authentication implementation, so the affected population is narrow — whoever integrates this Foundation flow — and exploitation depends on an attacker obtaining a valid signed message to replay. That's a meaningful weakness in the trust model of the auth process, but it's a targeted, protocol-level issue, not the kind of thing mass scanners spray at arbitrary hosts.

Our angle is scoped applicability. We first determine whether this Foundation Web3 auth path is actually part of any system we operate or depend on; for most estates it simply isn't present. Where it is, the correct framing is that signature replay undermines the authentication guarantee, so the fix — binding signatures to a server-issued nonce — is what matters, and we'd track it as an integration-level auth defect rather than a general-perimeter exposure.