On November 8, 2026, Lava Network issued a security alert about a potential vulnerability in Web3Auth, a third‑party login service, warning that some Keplr wallets created via Google or Apple accounts may be affected. Keplr has confirmed that the incident did not result from a compromise of its own code.
Web3Auth vulnerability and Keplr impact
Lava’s advisory, posted on X, was directed to LAVA holders, stakers and node providers and flagged the Web3Auth login issue as a potential risk to certain Keplr wallets that rely on Google or Apple account connections. Keplr said it is investigating the security incident while maintaining that its codebase remains secure.
Response and mitigation
A network upgrade is being considered to mitigate the identified risks. Users are advised to monitor their account activity closely for any unusual behavior and follow further guidance from Lava Network and Keplr as the investigation progresses.
