The vulnerability stems from the ability to submit an UpdateValidator transaction that supplies a new voting key without the required proof‑of‑knowledge. This omission bypasses the safeguard that prevents BLS rogue‑key attacks during public key aggregation. As a result, an attacker could introduce a rogue voting key into the validator set, enabling the forging of a quorum‑looking block justification with a single forged signature.

Nimiq nimiq-transaction library versions prior to 1.3.0 are affected. Users running those versions have the exposed flaw until they upgrade to the patched 1.3.0 release or later.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score is less than 1%. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require the attacker to become part of the next epoch’s validator set through the VRF selection process, which is unlikely. Therefore, while the potential impact is critical—allowing forging of block justifications—the actual exploitability is low and would normally be restricted to an already compromised validator node.