Executive brief
A security flaw in Yubico's Java-based WebAuthn server library could allow an attacker to impersonate another user. The library, which is used by developers to implement secure, passwordless logins, fails to properly verify that a security credential belongs to the specific user attempting to log in. This could allow a malicious actor with a valid account to bypass authentication and gain unauthorized access to other users' accounts.
Technical details
A vulnerability exists in Yubico webauthn-server-core (java-webauthn-server) versions 2.8.0 and 2.8.1 due to an incorrect check of a function's return value (CWE-253) within the second-factor authentication flow. Specifically, the 'RelyingParty.finishAssertion' and 'RelyingPartyV2.finishAssertion' methods may return a successful authentication result even if the provided credential belongs to a different user than the one specified in 'StartAssertionOptions.username'. An attacker with network access and a valid set of credentials could exploit this logic error to impersonate other users on the system. The issue is resolved in version 2.8.2.
Affected products
- Yubico webauthn-server-core (java-webauthn-server) 2.8.0 to 2.8.1
Timeline
- 2026-05-12: patched: Version 2.8.2 released with security fixes.
- 2026-05-14: advisory: YSA-2026-02 and CVE-2026-46419 published.