# Security Alert - cpp-ethereum keeps accounts unlocked

DevFeed: [Security Alert - cpp-ethereum keeps accounts unlocked](<https://devfeed.tech/articles/security-alert-cpp-ethereum-keeps-accounts-unlocked-16759.md>)

Original publisher: [Read original article](<https://blog.ethereum.org/en/2016/05/31/security-alert-cpp-ethereum-keeps-accounts-unlocked>)

Author: Christian Reitwiessner

Published: 2016-05-31T00:13:36Z

Content type: release

Language: en

Sources: [Ethereum Foundation Blog](<https://devfeed.tech/sources/ethereum-foundation-blog.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [bug](<https://devfeed.tech/topics/bug.md>), [Ethereum](<https://devfeed.tech/topics/ethereum.md>), [Remote Procedure Call (RPC)](<https://devfeed.tech/topics/rpc.md>), [HTTP](<https://devfeed.tech/topics/http.md>)

Tags: [account](<https://devfeed.tech/tags/account.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [binaries](<https://devfeed.tech/tags/binaries.md>), [bug](<https://devfeed.tech/tags/bug.md>), [ethereum](<https://devfeed.tech/tags/ethereum.md>), [filesystem](<https://devfeed.tech/tags/filesystem.md>), [http](<https://devfeed.tech/tags/http.md>), [json](<https://devfeed.tech/tags/json.md>), [local](<https://devfeed.tech/tags/local.md>), [password](<https://devfeed.tech/tags/password.md>), [rpc](<https://devfeed.tech/tags/rpc.md>), [security](<https://devfeed.tech/tags/security.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>)

## AI overview

A high-severity security bug in cpp-ethereum versions 1.2.0 through 1.2.5 left accounts unlocked after password entry until the client closed. Attackers with local-machine access or access to an exposed JSON-RPC interface could spend funds from previously used accounts. Version 1.2.6 fixes the issue.

## Source excerpt

Affected configurations: cpp-ethereum (eth, AlethZero, ...) version 1.2.0 up to 1.2.5 (fixed in 1.2.6) Note: Neither "geth" nor "Mist" nor the "Ethereum Wallet" (unless explicitly used together with cpp-ethereum) are affected by this, they lock accounts correctly again.Severity: HighPossible Attacks: