io.quarkus:quarkus-security-webauthn-deployment (>=2.13.8.final, <=3.18.0.cr1), io.quarkus:quarkus-test-security-webauthn (>=2.13.8.final, <=3.18.0.cr1) potentially affected by CVE-2024-12225 via io.quarkus:quarkus-security-webauthn (>=2.13.8.final, <=3.18.0.cr1)

io.quarkus:quarkus-security-webauthn MAVEN version =2.13.8.final, =2.13.8.final, =2.13.8.final, =3.18.0.cr1 Source cves: CVE-2024-12225 Source advisory: MEND:CVE-2024-12225...

CVE-2024-12225

A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide custom REST endpoints, the default...

Quarkus security vulnerabilities

Quarkus is a cloud-native Linux container-first framework for writing Java applications from the Quarkus open source. A security vulnerability exists in Quarkus that stems from an undisabled default REST endpoint in the quarkus-security-webauthn module, which could lead to arbitrary user login...

CVE-2024-12225: Authentication Bypass Using an Alternate Path or Channel

A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide custom REST endpoints, the default...

io.quarkus:quarkus-security-webauthn-deployment (>=3.0.0.alpha1, <=3.17.8), io.quarkus:quarkus-test-security-webauthn (>=3.0.0.alpha1, <=3.17.8) potentially affected by CVE-2024-12225 via io.quarkus:quarkus-security-webauthn (>=3.0.0.alpha1, <=3.17.8)

io.quarkus:quarkus-security-webauthn MAVEN version =3.0.0.alpha1, =3.0.0.alpha1, =3.0.0.alpha1, =3.17.8 Source cves: CVE-2024-12225 Source advisory: SNYK:JAVA-IOQUARKUS-9376953...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel through the default REST endpoints. An attacker can bypass authentication controls and potentially log in as an existing user without proper credentials by exploiting these...