Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one transport either LE or BR/EDR and replace a bonding already established on the opposing transport BR/EDR or LE potentially overwriting an authenticated key with an unauthenticated key or a key with greater entropy with one with less.