BrowserBox

BrowserBox — Remote Browser Isolation Bring the web to any system...safely. A full remote browser. Clientless access. Native performance. Self-host on Windows, macOS or Linux, or create cloud browser sessions through the API. Start a 7-Day Paid Evaluation · Buy a Commercial License · Talk to Sale...

filekey

🔐 FileKey FileKey is an offline web app that lets you quickly encrypt and share files using passkeys. No accounts, no tracking, no cloud. 🛡️ FileKey is free, open source, and privacy-first. Live at filekey.app. 🚀 Features ✅ Free & Open Source – Licensed under GPLv3. ✅ Accountless – No logins, no...

sdk

@cosignet/sdk Thin, zero-dependency TypeScript client for Cosignet — human-in-the-loop approval for high-risk AI-agent actions, with payload-bound passkey signatures. Put a human in the loop before a dangerous action runs: pause it, get an explicit passkey approval from a person Face ID / Touch I...

PGP-Tools

PGP Tools Open-source browser extension for PGP & AGE encryption and decryption. Built with Rust/WebAssembly. Private keys never touch the JS heap unless they have to. !PGP Tools side panel: encrypting a message to a recipient, with signing switched...

CVE-2025-26788

CVE-2025-26788 Environment Setup Step 1 - Verify Docker Desktop is running docker version Step 2 - Build Image cd C:\Users\jhcho\Desktop\passkey\CVE-2025-26788 docker build -t skfs . Step 3 - Run Container docker run -d --name skfs --hostname skfs.localdomain --privileged --cgroupns=host -v...

webauthn_tpm_portable

WebAuthn TPM Portable Credentials ⚠️ Early proof of concept. This project has not been thoroughly tested or audited. Do not use it for anything beyond experimentation. Portable, hardware-backed WebAuthn/passkey credentials that work across multiple devices using TPM 2.0. Traditional TPM credential...

CVE-2026-73313

CVE-2026-73313: Passkey credential not bound to login account XenForo before 2.3.13 can complete one user's two-step login with a passkey owned by a different user. What happens The passkey manager performs a global lookup using the credential ID supplied in the assertion and correctly verifies...

CVE-2026-65824

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taki...

CVE-2026-65824

OpenReception's appointment booking software (prior to version 2.2.1 ) is vulnerable to a replay attack involving invite confirmation tokens. An attacker capturing a pending token can replay it to obtain a passkey-registration credential, allowing them to register their own passkey and take contr...

CVE-2026-65824 OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taki...

CVE-2026-111949

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

CVE-2026-111949

The miniOrange 2FA WordPress plugin versions before 6.3.1 is vulnerable to a 2FA bypass due to improper handling of passkey registrations. The root cause is that the plugin fails to prevent a pending passkey login from registering an additional passkey on an account that already has one configure...

CVE-2026-111949 miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

EUVD-2026-107076

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

CVE-2026-111949 miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

PT-2026-120471

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

GO-2026-6786 TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI

TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI...

Authentication Bypass

github.com/0xjacky/nginx-ui is vulnerable to an authentication bypass. The vulnerability is due to OTP enrollment and passkey registration endpoints failing to require secure session validation and current password verification, which allows an attacker with a stolen JWT to register a malicious...

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...

GHSA-GFRC-G87H-7H5W Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...