CVE-2025-26788 Overview
CVE-2025-26788 is an authorization bypass vulnerability in StrongKey FIDO Server (SKFS) versions before 4.15.1. The server incorrectly treats a non-discoverable namedcredential authentication flow as a discoverable transaction. This logic flaw enables attackers to bypass passkey authentication controls, undermining the FIDO2/WebAuthn assurance model. The defect is tracked under CWE-639: Authorization Bypass Through User-Controlled Key. Public technical analysis is available from Securing.pl, and StrongKey documents the fix in the SKFS Release Notes.
Critical Impact
Authenticated attackers can bypass passkey-based authentication and access accounts belonging to other users through the named credential flow.
Affected Products
- StrongKey FIDO Server (SKFS) versions prior to 4.15.1
- Applications and identity providers integrating SKFS for WebAuthn/FIDO2 authentication
- Deployments relying on the namedcredential (non-discoverable) authentication flow
Discovery Timeline
- 2025-02-14 - CVE-2025-26788 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-26788
Vulnerability Analysis
StrongKey FIDO Server supports two WebAuthn authentication models. Discoverable credentials let the authenticator return any resident key matching the relying party. Non-discoverable credentials require the server to specify exact credential identifiers tied to a known user via the namedcredential flow.
SKFS fails to enforce this distinction. The server processes a namedcredential authentication request as if it were a discoverable transaction. The user identity asserted in the request is not bound to the credential ultimately verified. An attacker with a valid registered passkey can therefore complete authentication and assume the identity of another account.
The issue is a business logic and authorization flaw [CWE-639] rather than a memory safety or injection bug. The cryptographic operations succeed, but the server links the authenticated assertion to the wrong principal.
Root Cause
The root cause is missing validation that the credential ID returned by the authenticator matches the user identifier supplied in the namedcredential request. SKFS treats the flow as if any registered credential is acceptable, collapsing the non-discoverable contract into a discoverable one.
Attack Vector
Exploitation requires network access to the FIDO server and a valid registered passkey held by the attacker. The attacker initiates a namedcredential authentication targeting a victim account, then completes the WebAuthn ceremony using their own authenticator. Because the server does not bind the credential to the requested account, the resulting session is issued for the victim. The high attack complexity reflects the need for low-privilege account access and protocol-level interaction with the server APIs. Refer to the Securing.pl analysis for the full exploitation walkthrough.
Detection Methods for CVE-2025-26788
Indicators of Compromise
- Successful FIDO authentication events where the credential ID does not belong to the authenticated user account
- Authentication assertions returning a credential ID inconsistent with the username parameter sent in the preauthenticate request
- Sessions issued for accounts that did not originate the WebAuthn challenge from a recognized device
- Multiple namedcredential authentication requests from a single source targeting different user accounts
Detection Strategies
- Correlate SKFS preauthenticate and authenticate API calls and verify that the returned credential ID is registered to the requested user
- Alert on FIDO authentication events where the credential owner differs from the authenticated principal
- Compare authenticator AAGUID and credential metadata against the historical fingerprint for each user account
Monitoring Recommendations
- Forward SKFS application logs and authentication audit events to a centralized SIEM for correlation
- Track per-user passkey credential IDs and alert on first-time pairings during sensitive logins
- Monitor for spikes in namedcredential flow usage from low-privilege accounts
- Review identity provider session issuance logs for accounts that did not initiate a recent WebAuthn ceremony
How to Mitigate CVE-2025-26788
Immediate Actions Required
- Upgrade StrongKey FIDO Server to version 4.15.1 or later as documented in the SKFS Release Notes
- Audit recent authentication events for credential-to-user mismatches and revoke suspicious sessions
- Force re-authentication for any account that authenticated through the namedcredential flow during the exposure window
- Restrict network access to SKFS administrative and authentication endpoints to trusted relying parties
Patch Information
StrongKey addressed the vulnerability in SKFS 4.15.1. The fix enforces validation that the credential ID returned by the authenticator is bound to the user identity supplied in the non-discoverable flow. Operators should review the official StrongKey release notes for upgrade procedures and any required schema or configuration changes.
Workarounds
- Disable the namedcredential (non-discoverable) authentication flow at the relying party until the patch is deployed
- Require step-up authentication or a second factor for sensitive operations performed after passkey login
- Restrict SKFS API access through network segmentation and mutual TLS between relying parties and the FIDO server
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
