Mozilla Firefox WebAuthn Vulnerability Over Invalid TLS Certificate

A vulnerability in Mozilla Firefox allows a webpage with an invalid TLS certificate to present a WebAuthn challenge, which the user is prompted to complete. This behavior contradicts the WebAuthn specification, which mandates a secure transport without errors. The issue arises when a user accepts an exception for the invalid certificate. This vulnerability affects Firefox versions prior to 140.

Impact

Exploitation of this vulnerability could lead to unauthorized WebAuthn assertions, allowing users to inadvertently complete authentication challenges on insecure websites.

Remediation

Users can update to Firefox 140 to address this vulnerability.