HackerOne Disclosed Reports - 2025-07-31

Medium
resolved

total Failure of password protection while extracting seed phrase! increases attack surface area for scammers

Bug reported by Deepak was disclosed at July 31, 2025, 7:36 pm   |   Authentication Bypass Using an Alternate Path or Channel

The MetaMask browser extension UI was able to access a user's seed phrase without requiring password confirmation, which violated expected security boundaries between the UI and background process. The issue was resolved in MetaMask Extension version 11.7.1, which now enforces password confirmation before any UI code can access the wallet's seed phrase.