Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.
CVSS Details
CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
2.8.0
2.8.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// Conceptual PoC demonstrating the logic flaw
public class VulnerableAuthFlow {
public boolean processSecondFactor(User user, Token token) {
// Vulnerable function that should return boolean
boolean isValid = validateSignature(token);
// FLAW: The code might not check 'isValid' correctly,
// or assume the function throws an exception instead of returning false.
// Example of vulnerable logic (hypothetical):
try {
validateSignature(token); // Returns void or int, ignored return value
return true; // Always returns true if no exception
} catch (Exception e) {
return false;
}
}
}