PGP-Tools

Herramientas PGP Extensión de navegador de código abierto para cifrado, descifrado y firma PGP. Construida con Rust/WebAssembly. Las claves privadas nunca tocan el heap de JS a menos que sea necesario. Consíguelo aquí ¿Por qué Herramientas PGP? Código abierto y transparente. La mayoría de las...

BrowserBox

BrowserBox by DOSAYGO Secure, modern Remote Browser Isolation RBI with a clientless experience Read the BrowserBox docs → 🖥️ NEW in v18.10.0 — the BrowserBox desktop app BETA BrowserBox now ships with a desktop app for running your BrowserBox without the command line. Start and stop sessions, pick...

EUVD-2026-92914

A flaw was found in sssd. A local attacker can trigger a Denial of Service DoS by sending a specially crafted Pluggable Authentication Module PAM request when passkey authentication is enabled. Due to a missing state validation check in passkey Kerberos handling, the PAM responder dereferences an...

CVE-2026-104044

A flaw exists in sssd where a local attacker can trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM) request. When passkey authentication is enabled, a missing state validation check in passkey Kerberos handling causes the PAM responder to derefe...

EUVD-2026-92759

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash a...

CVE-2026-104030

A flaw in sssd allows a local user to trigger a Denial of Service (DoS) by providing a specially crafted passkey authentication token that lacks null terminators. This results in an out-of-bounds read (CWE-125) where the authentication service reads past the end of the provided memory buffer, cau...

webauthn_tpm_portable

WebAuthn TPM Portable Credentials ⚠️ Early proof of concept. This project has not been thoroughly tested or audited. Do not use it for anything beyond experimentation. Portable, hardware-backed WebAuthn/passkey credentials that work across multiple devices using TPM 2.0. Traditional TPM credential...

CVE-2026-105212

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

CVE-2026-105212

ZITADEL versions prior to 3.4.14 and 4.16.2 are vulnerable to an authentication bypass in the hosted Login V1 and Login V2 UIs. The root cause is the system's acceptance of passkey or other authenticator enrollments during identify-only login sessions before a primary factor is verified. This all...

CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

CVE-2026-105209 ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...

CVE-2026-105209 ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...

CVE-2026-105209

ZITADEL versions 3.x before 3.4.15 and 4.x before 4.17.1 are vulnerable to an improper authorization flaw (CWE-862) during passkey or passwordless enrollment. The system incorrectly validates the organization ID provided in the x-zitadel-orgid header instead of verifying the target user's actual ...

PT-2026-104636

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

filekey

🔐 FileKey FileKey is an offline web app that lets you quickly encrypt and share files using passkeys. No accounts, no tracking, no cloud. 🛡️ FileKey is free, open source, and privacy-first. Live at filekey.app. 🚀 Features ✅ Free & Open Source – Licensed under GPLv3. ✅ Accountless – No logins, no...

poseidon

██████╗ ██████╗ ███████╗███████╗██╗██████╗ ██████╗ ███╗ ██╗ ██╔══██╗██╔═══██╗██╔════╝██╔════╝██║██╔══██╗██╔═══██╗████╗ ██║ ██████╔╝██║ ██║███████╗█████╗ ██║██║ ██║██║ ██║██╔██╗ ██║ ██╔═══╝ ██║ ██║╚════██║██╔══╝ ██║██║ ██║██║ ██║██║╚██╗██║ ██║ ╚██████╔╝███████║███████╗██║██████╔╝╚██████╔╝██║ ╚████...

CVE-2026-73313

CVE-2026-73313: Passkey credential not bound to login account XenForo before 2.3.13 can complete one user's two-step login with a passkey owned by a different user. What happens The passkey manager performs a global lookup using the credential ID supplied in the assertion and correctly verifies...

CVE-2025-26788

CVE-2025-26788 Environment Setup Step 1 - Verify Docker Desktop is running docker version Step 2 - Build Image cd C:\Users\jhcho\Desktop\passkey\CVE-2025-26788 docker build -t skfs . Step 3 - Run Container docker run -d --name skfs --hostname skfs.localdomain --privileged --cgroupns=host -v...