Executive brief
SimpleWebAuthn is a TypeScript library used to validate WebAuthn/FIDO2 credentials during registration. The library is responsible for verifying that credentials are backed by genuine authenticators from trusted manufacturers. A flaw in its certificate validation logic allows attackers to register fake credentials with forged certificates that pass validation, effectively bypassing manufacturer trust verification and allowing registration of credentials that should have been rejected.
Technical details
The vulnerability is a certificate chain validation bypass in the validateCertificatePath() function in packages/server/src/helpers/validateCertificatePath.ts. The function appends a configured trust anchor (e.g., Apple or Google root certificate) to the end of an untrusted certificate chain, then walks the chain to verify each certificate is signed by the next. However, the walk terminates at the first self-signed certificate it encounters with a break statement, never reaching the appended trust anchor. An attacker can send a certificate chain with a forged leaf certificate signed by an attacker-controlled self-signed root, which will pass validation because the attacker controls both certificates in the chain, even though the chain never chains to the legitimate trust anchor. The impact is integrity-related; an attacker can impersonate authenticated users by registering false credentials. Patched in version 13.3.2.
Affected products
- MasterKale SimpleWebAuthn <= 13.3.1
Timeline
- 2026-09-04: disclosed: Published to GitHub Advisory Database
- 2026-09-04: patched: Fixed in version 13.3.2
References
- https://api.github.com/users/Josh-TantoSec
- https://github.com/Josh-TantoSec
- https://api.github.com/users/Josh-TantoSec/gists%7B/gist_id%7D
- https://api.github.com/users/Josh-TantoSec/repos
- https://avatars.githubusercontent.com/u/195698411?v=4
- https://api.github.com/users/Josh-TantoSec/events%7B/privacy%7D