Back to security portal
Trezor Model One advanced recovery requirement could be bypassed
Reported on August 2, 2026
On Trezor Model One, a host could get around the requirement to use advanced recovery for 12- and 18-word backups. Fixed in firmware 1.14.2
Reported by pausetherace
Reward 600 USD
Resolved vulnerabilities
Reported by community. Investigated. Resolved. Because your security is never optional.
- Trezor T Bootloader firmware update retry could skip header checksSeptember 29, 2026
- E-shop referral discount could be applied to eGift card purchasesSeptember 16, 2026
- Authenticity proofs not bounded to their secure element on TS7August 16, 2026
- Monero payment ID could be signed without being shownAugust 13, 2026
- Missing bounds check in JPEG image decodingAugust 12, 2026
- Cardano output datum and reference script not shown in simple transactionsAugust 11, 2026