fix(python): don't pair when auto-connected after unlocking
What the developer wrote
Authored by Roman Zeyde
fix(python): don't pair when auto-connected after unlocking
Fixes #6633.
What changed, and why it matters
This commit fixes a bug in the Trezor Python library's pairing flow for Trezor Host Protocol (THP). Before the fix, the code could check whether a device was already paired without first ensuring a communication channel was open. The fix explicitly opens the connection first and skips pairing if the device is already paired. The changelog describes it as fixing auto-connection after unlocking the device. There is no direct evidence in the commit of a security vulnerability being exploited.
Treat as a bug fix with possible minor security hardening. Review issue #6633 for full context. No urgent security response is warranted based solely on this diff, but users of the Python library should update to avoid auto-connection/pairing glitches after unlocking.
Security signals we found
Fixes a reported issue (#6633) related to THP auto-connection after device unlock
Adds explicit connection establishment before pairing state check
Prevents pairing flow from running when device is already paired
No explicit security language in commit message or changelog
Evidence from the diff
In python/src/trezorlib/thp/pairing.py, the default_pairing_flow() function now calls pairing.client.connect() before checking pairing.is_paired(). If already paired, it returns early. The change prevents the pairing flow from proceeding when a device auto-connects after unlocking. The actual security implications are unclear from the diff alone; it may prevent unintended pairing attempts, repeated user prompts, or race conditions, but no explicit vulnerability is described.
Changed components
python/src/trezorlib/thp/pairing.pyTrezor Host Protocol (THP) pairing flow in trezorlib Python libraryInspect captured patch +4 / −0
diff --git a/python/.changelog.d/6633.fixed b/python/.changelog.d/6633.fixed
new file mode 100644
index 00000000..cd4284a4
--- /dev/null
+++ b/python/.changelog.d/6633.fixed
@@ -0,0 +1 @@
+Fix THP auto-connection after unlocking the device.
diff --git a/python/src/trezorlib/thp/pairing.py b/python/src/trezorlib/thp/pairing.py
index bf2ed7ee..6e1382ea 100644
--- a/python/src/trezorlib/thp/pairing.py
+++ b/python/src/trezorlib/thp/pairing.py
@@ -386,6 +386,9 @@ def default_pairing_flow(
code_entry_callback: t.Callable[[], str] | None = None,
request_credential: bool = True,
) -> Credential | None:
+ # make sure a channel has been established
+ pairing.client.connect()
+ # no need to pair if auto-connected
if pairing.is_paired():
return
Why this scored 33/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.