filekey

🔐 FileKey FileKey is an offline web app that lets you quickly encrypt and share files using passkeys. No accounts, no tracking, no cloud. 🛡️ FileKey is free, open source, and privacy-first. Live at filekey.app. 🚀 Features ✅ Free & Open Source – Licensed under GPLv3. ✅ Accountless – No logins, no...

sdk

@cosignet/sdk Thin, zero-dependency TypeScript client for Cosignet — human-in-the-loop approval for high-risk AI-agent actions, with payload-bound passkey signatures. Put a human in the loop before a dangerous action runs: pause it, get an explicit passkey approval from a person Face ID / Touch I...

BrowserBox

BrowserBox — Remote Browser Isolation Bring the web to any system...safely. A full remote browser. Clientless access. Native performance. Self-host on Windows, macOS or Linux, or create cloud browser sessions through the API. Start a 7-Day Paid Evaluation · Buy a Commercial License · Talk to Sale...

PGP-Tools

PGP Tools Open-source browser extension for PGP & AGE encryption and decryption. Built with Rust/WebAssembly. Private keys never touch the JS heap unless they have to. !PGP Tools side panel: encrypting a message to a recipient, with signing switched...

CVE-2025-26788

CVE-2025-26788 Environment Setup Step 1 - Verify Docker Desktop is running docker version Step 2 - Build Image cd C:\Users\jhcho\Desktop\passkey\CVE-2025-26788 docker build -t skfs . Step 3 - Run Container docker run -d --name skfs --hostname skfs.localdomain --privileged --cgroupns=host -v...

webauthn_tpm_portable

WebAuthn TPM Portable Credentials ⚠️ Early proof of concept. This project has not been thoroughly tested or audited. Do not use it for anything beyond experimentation. Portable, hardware-backed WebAuthn/passkey credentials that work across multiple devices using TPM 2.0. Traditional TPM credential...

CVE-2026-73313

CVE-2026-73313: Passkey credential not bound to login account XenForo before 2.3.13 can complete one user's two-step login with a passkey owned by a different user. What happens The passkey manager performs a global lookup using the credential ID supplied in the assertion and correctly verifies...

CVE-2026-65824

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taki...

CVE-2026-65824 OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taki...

EUVD-2026-109155

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taki...

CVE-2026-65824 OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taki...

CVE-2026-65824

OpenReception's appointment booking software (prior to version 2.2.1 ) is vulnerable to a replay attack involving invite confirmation tokens. An attacker capturing a pending token can replay it to obtain a passkey-registration credential, allowing them to register their own passkey and take contr...

PT-2026-122226

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taki...

CVE-2026-111949

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

CVE-2026-111949 miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

CVE-2026-111949

The miniOrange 2FA WordPress plugin versions before 6.3.1 is vulnerable to a 2FA bypass due to improper handling of passkey registrations. The root cause is that the plugin fails to prevent a pending passkey login from registering an additional passkey on an account that already has one configure...

EUVD-2026-107076

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

CVE-2026-111949 miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

PT-2026-120471

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor...

GO-2026-6786 TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI

TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI...