147 matches found
GHSA-G3QJ-J598-CXMQ fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Summary fido2-lib v3.x depends on cbor-x 1.6.0, which optionally pulls in cbor-extract C++ native addon. cbor-extract = 2.2.0 has a heap buffer over-read in extractStrings — a 5-byte CBOR payload crashes Node.js with SIGSEGV. No JS exception, no try/catch, process dead. The crash triggers during...
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Summary fido2-lib v3.x depends on cbor-x 1.6.0, which optionally pulls in cbor-extract C++ native addon. cbor-extract = 2.2.0 has a heap buffer over-read in extractStrings — a 5-byte CBOR payload crashes Node.js with SIGSEGV. No JS exception, no try/catch, process dead. The crash triggers during...
@chainless-js/biometric-ed25519 (>=1.2.4, <=1.2.6), @forwardemail/wildduck (>=1.40.10, <=4.0.3) +17 more potentially affected by unknown CVE via fido2-lib (>=3.2.5, <=3.5.6)
fido2-lib NPM version =3.2.5, =1.2.4, =1.40.10, =8.0.1, =7.0.0, =5.8.38, =6.6.6, =0.0.2, =0.0.1, =1.0.0-alpha.1, =1.2.3, =6.0.0, =5.8.30, =1.46.1, =1.46.25 and more Source cves: unknown CVE Source advisory: OSV:GHSA-G3QJ-J598-CXMQ...
YSA-2026-01 | Yubico
Security updates which resolve a DLL search path vulnerability on Windows are available for three Yubico open source software projects: libfido2, YubiKey Manager, and python-fido2. If an attacker is able to place a malicious file in the directory where the affected software or Python is installed...
EUVD-2021-18797
Malware in sbrugna...
EUVD-2021-22989
Malware in sbrugna...
EUVD-2020-19727
Malware in sbrugna...
EUVD-2021-1997
Malware in sbrugna...
EUVD-2021-27982
Malicious code in bioql PyPI...
EUVD-2023-53212
Malicious code in bioql PyPI...
EUVD-2022-34476
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2023-49208
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration. CVE-2023-4920...
FIDO2 Authentication Does Not Work With Webpages Opened Using Microsoft Edge
Users are not able to Authenticate to a website that requires FIDO2 Authentication using a Yubikey when using Edge on VDA Devices. The users are constantly prompted to select a Smartcard device. The same users are able to Authenticate onto the same website using Chrome or Firefox inside the same...
CVE-2021-38299
Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence...
Microsoft Edge browser closes unexpectedly inside Published Desktop when using FIDO2 Authentication
FIDO2 Redirection is enabled to authenticate web application inside Published Desktop. MSedge browser closes unexpectedly at the web application authentication page, no error message on the desktop nor in the Windows event log. This issue only occurs with MSedge. No issue with Chrome or Firefox...
CVE-2022-2193
Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via parameter tampering in the Device Manager page. This issue affects: HYPR Server versions prior to 6.14.1...
FIDO2 redirection in Chrome and Edge doesn't work
https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/secure/fido2.htmllocal-authorization-and-virtual-authentication-using-fido2-and-webauthn was followed. However devices which use Fido2 such as fingerprint readers and YubiKey devices are not detected in the browser,...
TDECU data breach affects half a million people
The Texas Dow Employees Credit Union TDECU has filed a data breach notification, reporting that the data of 500,474 people has been accessed in an external system breach. TDECU is the largest Houston-area credit union, and the fourth largest in the state of Texas. The credit union was founded by...
GHSA-875X-G8P7-5W27 The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames
Summary The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found. Details When WebAuthn is used as the first or only authentication method, an attacker can enumerate usernames based on the absence of the allowedCredentials property i...
The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames
Summary The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found. Details When WebAuthn is used as the first or only authentication method, an attacker can enumerate usernames based on the absence of the allowedCredentials property i...