Nimiq, a Rust-based implementation of the Nimiq Proof‑of‑Stake protocol, contains an off‑by‑one error in its validity store logic that expires stored transactions earlier than intended. This flaw permits a remote actor to replay a signed transaction within a one‑block window, causing the sender and recipient balances to be updated twice. The resulting double‑spend effect undermines transaction integrity, leading to financial loss and ledger inconsistency.

The vulnerability affects the Nimiq core‑rs‑albatross product, specifically version 1.5.0 delivered by the Nimiq vendor. The issue was resolved in version 1.5.1, so any node running 1.5.0 or older is at risk while those on 1.5.1 or later are no longer vulnerable.

The CVSS score of 7.5 indicates a medium‑to‑high risk, and EPSS data is not available, so an exact exploit probability cannot be established. The vulnerability is not listed in CISA’s KEV catalog, but it can be exploited by any external participant who can submit a transaction into the network while the replay window remains open. Because the flaw requires only the ability to send transactions, no local privilege or special credentials are necessary.