Executive brief
SimpleWebAuthn is a JavaScript library that implements WebAuthn registration and authentication for secure passwordless login. The library's certificate validation logic fails to properly verify that attestation certificates chain to a legitimate trust anchor (such as Apple, Google, or Yubikey roots). An attacker can register a forged credential with a self-signed certificate and have the server accept it as if it were backed by a genuine authenticator, bypassing the intended security checks.
Technical details
The vulnerability exists in the validateCertificatePath() function in packages/server/src/helpers/validateCertificatePath.ts. The function appends the configured trust anchor to the certificate chain but exits early when it encounters the first self-signed certificate without verifying that it matches one of the trusted roots. An attacker can supply a chain like [forgedLeaf (signed by attacker root), attackerSelfSignedRoot], which the library concatenates with the configured anchor. During chain validation, the function verifies that forgedLeaf is signed by the attacker's root, finds the self-signed root, and exits—never checking whether it chains to the actual Apple/Google/etc. root appended at the end. This allows credential registration with forged attestation. The vulnerability affects all versions before 13.3.2, and patches are available in commits 67a41fed, 8a53d70, and dd0d73c.
Affected products
- SimpleWebAuthn @simplewebauthn/server < 13.3.2
Timeline
- 2026-09-04: disclosed: Advisory published
- 2026-09-04: patched: Fixed in version 13.3.2