CVE-2026-73313

CVE-2026-73313: Passkey credential not bound to login account XenForo before 2.3.13 can complete one user's two-step login with a passkey owned by a different user. What happens The passkey manager performs a global lookup using the credential ID supplied in the assertion and correctly verifies...

CVE-2022-28281

CVE-2022-28281: Mozilla Firefox Out of bounds write due to unexpected WebAuthN Extensions This is a bug that can be triggered from a compromised Windows Firefox renderer process. If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent...

authentik

What is authentik? authentik is an open-source Identity Provider IdP for modern SSO. It supports SAML, OAuth2/OIDC, LDAP, RADIUS, and more, designed for self-hosting from small labs to large production clusters. Our enterprise offering is available for organizations to securely replace existing...

Shwmae

Shwmae Shwmae shuh-my is a Windows Hello abuse tool that was released during DEF CON 32 as part of the Abusing Windows Hello Without a Severed Hand talk. The purpose of the tool is to abuse Windows Hello from a privileged user context. Shwmae Copyright C 2024 Shwmae enum Default Verb Enumerate...

CVE-2025-26788

CVE-2025-26788 Environment Setup Step 1 - Verify Docker Desktop is running docker version Step 2 - Build Image cd C:\Users\jhcho\Desktop\passkey\CVE-2025-26788 docker build -t skfs . Step 3 - Run Container docker run -d --name skfs --hostname skfs.localdomain --privileged --cgroupns=host -v...

ephemera

Ephemera : Zero-Trust SSH Certificate Authority Ephemera is a lightweight, self-hosted SSH Certificate Authority designed to enforce Zero-Trust access for infrastructure. It replaces static SSH keys with short-lived certificates, integrates hardware-backed WebAuthn MFA, and maintains...

kl-security-key

KL Security Key Experimental open-source RP2040 FIDO2/WebAuthn authenticator engineering and interoperability project by Karaaslan Labs. Status: engineering/research project. Not FIDO Alliance certified. Not a commercial high-assurance security token. Evidence boundary: the real-device observatio...

CVE-2026-111911

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, th...

CVE-2026-111911

The software phpMyFAQ (versions 4.0.0 before 4.1.9) contains an authentication bypass vulnerability related to its WebAuthn registration endpoints. The root cause is that these endpoints attach credentials to any account without requiring proper authentication or challenge validation. An attacker...

CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, th...

CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, th...

EUVD-2026-103309

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, th...

PT-2026-116481

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.0.0 through 4.1.8 Description An authentication bypass exists during the WebAuthn registration process. The registration endpoints allow credentials to be attached to any account without requiring a valid session or challen...

GHSA-GFRC-G87H-7H5W Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...

CVE-2026-55587

The AliasVault browser extension, prior to version 0.29.4 , contains a WebAuthn bridge vulnerability where it fails to bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origi...

CVE-2026-55587 AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A maliciou...

Astra Linux – Vulnerability in Firefox and Thunderbird

An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have led to cross-origin account linking, violating the WebAuthn goals. This vulnerability affect...

Linux Distros Unpatched Vulnerability : CVE-2026-55167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with...

DEBIAN-CVE-2026-55167

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...