Back to security portal
Missing confirmation in the ECDHSessionKey call
Reported on November 26, 2023
The Trezor Safe 3 returns the ECDHSessionKey without requiring appropriate user interaction, resulting in the omission of address confirmation screens in the user interaction workflow.
This concerns only the SSH functionality in Trezor and was fixed in 2.6.4.
Reported by Mathias Herberts
Trezor Safe 3
Resolved vulnerabilities
Reported by community. Investigated. Resolved. Because your security is never optional.
- Authenticity proofs not bounded to their secure element on TS7August 16, 2026
- THP pairing could be completed without the pairing codeJune 22, 2026
- Desktop update could install before signature verification completedJune 16, 2026
- Solana account-creation confirmation completenessJune 14, 2026
- Solana signing display improvementJune 12, 2026
- Coordination fee cap shown on CoinJoin authorizationJune 3, 2026