Nimiq's BlockInclusionProof::is_block_proven function contains a logic flaw that lets it return true without performing any cryptographic verification when get_interlink_hops produces an empty list; as a result an attacker who supplies forged transaction inclusion proofs can convince a node that a MacroBlock header for a specific epoch position is proven, enabling the creation of false inclusion proofs that undermine the ledger’s integrity, with the weakness corresponding to CWE‑345.

The vulnerability affects the Rust implementation of the Nimiq Proof‑of‑Stake protocol, specifically the nimiq core rs albatross product; all releases prior to version 1.4.0 are susceptible, while version 1.4.0 and later include the fix.

The CVSS base score is 5.9, indicating medium severity; there is no EPSS score available and the issue is not listed in the CISA KEV catalog; the attack likely requires remote interaction with a node that accepts transaction inclusion proofs through its RPC or peer‑to‑peer interfaces, and would allow an attacker to forge inclusion proofs without cryptographic validation, potentially leading to unauthorized transaction inclusion and ledger manipulation.