Brave's research team has released a report identifying significant security and privacy risks in the blockchain transaction authorization system zkLogin. The report emphasizes that these risks are not solely dependent on the underlying zero-knowledge proof but are heavily reliant on several protocol-level assumptions. These include JWT/JSON parsing, issuer trust policies, issuance context binding, and execution environment integrity. The report categorizes three main vulnerabilities: the acceptance of malformed JWTs due to lax claim extraction standards, the conversion of short-term authentication credentials into long-term authorization credentials without enforcing issuer/audience/subject/time binding, which could lead to cross-application misuse, particularly in browser environments. The report stresses that these issues are not due to flaws in the cryptographic algorithms themselves.