--- title: zkLogin: when ZKP is not enough | daily.dev description: Security researchers at Brave identified critical vulnerabilities in zkLogin, a zero-knowledge proof-based authorization system used in the Sui blockchain... canonical: https://daily.dev/posts/zklogin-when-zkp-is-not-enough-tvrkv8oi8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: zkLogin: when ZKP is not enough | daily.dev og:description: Security researchers at Brave identified critical vulnerabilities in zkLogin, a zero-knowledge proof-based authorization system used in the Sui blockchain... og:url: https://daily.dev/posts/zklogin-when-zkp-is-not-enough-tvrkv8oi8 og:image: https://api.daily.dev/og/posts/tvRkV8oi8.png og:image:alt: zkLogin: when ZKP is not enough og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # zkLogin: when ZKP is not enough **[Brave](https://daily.dev/sources/brave)** · 29 min read · 0 upvotes · 0 comments ## Summary Security researchers at Brave identified critical vulnerabilities in zkLogin, a zero-knowledge proof-based authorization system used in the Sui blockchain ecosystem. The analysis reveals three major vulnerability classes: ambiguous JWT parsing that allows claim shadowing and parser differentials, weak binding between authentication and authorization enabling cross-RP impersonation attacks, and centralization risks from outsourced proving services. The core issue is that zkLogin's security depends not just on cryptographic proofs, but on external assumptions about document correctness, issuer governance, and execution environments that the protocol doesn't enforce. The research demonstrates that repurposing short-lived OIDC tokens into long-lived authorization credentials without proper validation, canonical parsing, and cryptographic binding creates exploitable attack surfaces even when the underlying ZKP cryptography is sound. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [The limits of zero-knowledge for age-verification](https://daily.dev/posts/the-limits-of-zero-knowledge-for-age-verification-ju0r1px1e) · Brave · 1 upvotes · 0 comments - [Granular Policy Enforcement in Quantum Secure Discovery Services](https://daily.dev/posts/granular-policy-enforcement-in-quantum-secure-discovery-services-qgjun5wgp) · Security Boulevard · 1 upvotes · 0 comments - [Introducing zkAPI: private usage credits for any API](https://daily.dev/posts/introducing-zkapi-private-usage-credits-for-any-api-hg86btyxu) · Ethereum · 0 upvotes · 0 comments - [Zero-Knowledge Proofs \(ZKPs\): The Privacy Primitive Powering Web3](https://daily.dev/posts/zero-knowledge-proofs-zkps-the-privacy-primitive-powering-web3-znhu7ocez) · Coins Bench · 12 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#blockchain](https://daily.dev/tags/blockchain), [#oauth](https://daily.dev/tags/oauth), [#security](https://daily.dev/tags/security), [#zero-knowledge-proofs](https://daily.dev/tags/zero-knowledge-proofs) [View this post on daily.dev](https://daily.dev/posts/zklogin-when-zkp-is-not-enough-tvrkv8oi8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"zkLogin: when ZKP is not enough","url":"https://daily.dev/posts/zklogin-when-zkp-is-not-enough-tvrkv8oi8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/zklogin-when-zkp-is-not-enough-tvrkv8oi8"},"datePublished":"2026-02-13T17:08:06.456Z","dateModified":"2026-05-07T02:12:40.633Z","description":"Security researchers at Brave identified critical vulnerabilities in zkLogin, a zero-knowledge proof-based authorization system used in the Sui blockchain...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6477d48d1b0a98635403d5ed31a962bd?_a=AQAEunF","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6477d48d1b0a98635403d5ed31a962bd?_a=AQAEunF","isAccessibleForFree":true,"articleSection":"Brave","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Brave","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/12f1006df9d246a39d7fba20ab78bcba","url":"https://daily.dev/sources/brave"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/zklogin-when-zkp-is-not-enough-tvrkv8oi8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,blockchain,oauth,security,zero-knowledge-proofs","timeRequired":"PT29M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Brave","item":"https://daily.dev/sources/brave"},{"@type":"ListItem","position":3,"name":"zkLogin: when ZKP is not enough"}]} ```