Back to security portal
THP pairing could be completed without the pairing code
Reported on June 22, 2026
A host could complete Trezor Safe 7 pairing without using the code shown on the device, by supplying a degenerate value in the pairing key exchange. Such values are now rejected.
Reported by [email protected]
Resolved vulnerabilities
Reported by community. Investigated. Resolved. Because your security is never optional.
- Desktop update could install before signature verification completedJune 16, 2026
- Solana account-creation confirmation completenessJune 14, 2026
- Solana signing display improvementJune 12, 2026
- Coordination fee cap shown on CoinJoin authorizationJune 3, 2026
- Solana token-transfer recipient spoofing via Address Lookup Table referenceJune 1, 2026
- Open Redirect on trezor.io via /admin Cloudflare RewriteMay 29, 2026