Description

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-02T19:17:16.490Z",
  "pubdate": "2026-09-02T19:17:16.490Z",
  "executiveSummary": "This vulnerability is an authentication bypass flaw residing in the FIDO2 implementation for on-premises deployments. It allows an attacker to perform an unauthorized registration of a FIDO2 credential linked to a target account, effectively establishing a persistent mechanism for unauthorized access.\nThe vulnerability type is categorized as an improper authentication or credential management flaw. By exploiting this, an attacker can bypass standard authentication controls, leading to full account takeover. The impact is critical, as it compromises the integrity of the multi-factor authentication process.\nThis issue is limited to on-premises deployments. The attack requires the ability to interact with the authentication registration flow. Once a rogue FIDO2 credential is bound to the target account, the attacker can leverage it to authenticate as the victim, bypassing primary authentication or existing MFA requirements. There is no indication that remote network access is required if the attacker can intercept or manipulate the registration request locally or via man-in-the-middle positioning within the internal environment.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient validation process during the FIDO2 credential registration handshake. Specifically, the system fails to adequately verify the authenticity and authorization context of the registration request before binding a public key to a user profile.\nIn a secure FIDO2 implementation, the registration process requires a challenge-response mechanism where the Relying Party (RP) validates the attestation statement provided by the authenticator. This vulnerability suggests a bypass in the server-side verification logic, allowing an attacker to inject an attacker-controlled public key into the account's authentication store.\nThe exploitation flow proceeds as follows: First, the attacker identifies a target account that is susceptible to registration manipulation. Second, the attacker initiates a FIDO2 registration sequence against the affected service. Due to the lack of strict server-side authorization checks, the service accepts the malicious credential as a valid second-factor or primary authentication token. Third, the service associates the attacker's public key with the victim's account identifier within the on-premises database.\nOnce the registration is finalized, the attacker can trigger the authentication process. Because the server recognizes the attacker’s credential as legitimately registered, it issues a session token or completes the authentication challenge upon verification of the signed assertion from the attacker’s FIDO2 device. This permits the attacker to bypass standard password-based authentication or other existing MFA methods that might otherwise be required.\nThe vulnerability resides in the backend authentication module responsible for parsing and committing FIDO2 attestation objects. Because this is limited to on-premises deployments, the vulnerable code is likely part of the local identity management or web authentication service hosted within the internal network perimeter. The attack does not require specialized hardware, as the attacker can emulate a FIDO2 authenticator via software-based attestation tools to provide the necessary protocol responses required by the flawed validation logic. The post-exploitation impact is complete account takeover, granting the attacker the same level of access and permissions assigned to the target user account, which may lead to lateral movement within the on-premises environment."
}