Yubico WebAuthn Server Core User Impersonation Vulnerability

A user impersonation vulnerability has been identified in Yubico WebAuthn Server Core versions 2.8.0 prior to 2.8.2. The issue arises in the 'second factor' authentication flow, where the software incorrectly validates return values, allowing an attacker with an existing account to authenticate as another user who lacks a registered WebAuthn credential.

Impact

Exploitation of this vulnerability allows for user impersonation, where an attacker can authenticate as a target user without their consent or knowledge.

Remediation

Users are advised to update to Yubico WebAuthn Server Core version 2.8.2 or 2.9.0 or later. Additionally, if implementing the 'CredentialRepository' or 'UsernameRepository' interfaces, ensure that the methods return unique, non-empty results for registered usernames. Avoid using certain RelyingParty methods that could introduce the vulnerability.