diff --git a/advisories/github-reviewed/2024/11/GHSA-7f6p-phw2-8253/GHSA-7f6p-phw2-8253.json b/advisories/github-reviewed/2024/11/GHSA-7f6p-phw2-8253/GHSA-7f6p-phw2-8253.json
new file mode 100644
index 00000000000..8020e63b6b4
--- /dev/null
+++ b/advisories/github-reviewed/2024/11/GHSA-7f6p-phw2-8253/GHSA-7f6p-phw2-8253.json
@@ -0,0 +1,70 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7f6p-phw2-8253",
+  "modified": "2024-11-25T15:11:11Z",
+  "published": "2024-11-25T15:11:11Z",
+  "aliases": [
+
+  ],
+  "summary": "Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws",
+  "details": "Coinbase researchers reported 2 security issues in our implementation of the oblivious transfer (OT) based protocol [DKLS](https://eprint.iacr.org/2018/499.pdf):\n\n### 1. Secret share recovery attack\n\nIf the base OT setup of the protocol is reused for another execution of the OT extension, then a malicious participant can extract a bit of the secret of another participant. By repeating the execution they can eventually recover the whole secret.\n\nTherefore, unlike our comments suggested, you **must not reuse an OT setup** for multiple protocol executions. \n\nWe're adding a warning in the code:\n\nhttps://github.com/taurushq-io/multi-party-sig/blob/9e4400fccee89be6195d0a12dd0ed052288d5040/internal/ot/extended.go#L114\n\n### 2. Invalid security proof due to incorrect operator\n\nThe original 2018 version of the DKLS had a typo in the OT extension protocol when computing the check value in the OT extension: the paper noted a XOR whereas it should be a field multiplication. This erroneous behavior was implemented [in our code](https://github.com/taurushq-io/multi-party-sig/blob/4d84aafb57b437da1b933db9a265fb7ce4e7c138/internal/ot/extended.go#L188). \n\nThe proof of security fails in this case. No concrete attack is known, however.\n\nThe [2023 update](https://eprint.iacr.org/2018/499.pdf) of the DKLS paper reported that typo and updated the protocol definition.\n\nAs of 20241124, patching is in progress (branch [otfix](https://github.com/taurushq-io/multi-party-sig/tree/otfix)), but not merged to the main branch yes as the tests fail to pass. We're troubleshooting the issue and will merge into the main branch when it's resolved.\n\n### Workarounds\n\nDo not reuse an OT setup, to eliminate the secret recovery attack.\n  \nAvoid using our implementation of the DKLS protocol until we patch it, and maybe avoid DKLS altogether.\n\n### Credits\n\nThank you to the Coinbase researchers Yi-Hsiu Chen and Samuel Ranellucci for discovering these issues and providing a comprehensive write-up. Thank you to Yehuda Lindell for coordinating the disclosure.\n\n\n",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/taurusgroup/multi-party-sig"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.6.0-alpha-2021-09-21"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/taurushq-io/multi-party-sig/security/advisories/GHSA-7f6p-phw2-8253"
+    },
+    {
+      "type": "WEB",
+      "url": "https://eprint.iacr.org/2018/499.pdf"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/taurushq-io/multi-party-sig"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/taurushq-io/multi-party-sig/blob/4d84aafb57b437da1b933db9a265fb7ce4e7c138/internal/ot/extended.go#L188"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/taurushq-io/multi-party-sig/blob/9e4400fccee89be6195d0a12dd0ed052288d5040/internal/ot/extended.go#L114"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/taurushq-io/multi-party-sig/tree/otfix"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-25T15:11:11Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file