PT-2025-7238 · Strongkey · Strongkey Fido Server

Natalia Trojanowska-Korepta · CVE-2025-26788 · Published 2025-02-14 · Updated 2025-08-07

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions: StrongKey FIDO Server versions prior to 4.15.1

Description: The issue arises when the StrongKey FIDO Server treats a non-discoverable (namedcredential) flow as a discoverable transaction. This can potentially lead to security risks. However, specific details about the estimated number of affected devices or real-world incidents where this issue was exploited are not provided.

Recommendations: For versions prior to 4.15.1, update to version 4.15.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the namedcredential flow to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-26788

Affected Products

Strongkey Fido Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-26788 · Security Note
• https://reddit.com/r/CVEWatch/comments/1mjw1lc/top_10_trending_cves_07082025 · Reddit Post
• https://t.me/cvenotify/111353 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1mj0l93/top_10_trending_cves_06082025 · Reddit Post
• https://t.me/cvedetector/18079 · Telegram Post
• https://t.me/latest_high_impact_cve/1831 · Telegram Post
• https://t.me/cvenotify/111502 · Telegram Post
• https://securing.pl/en/cve-2025-26788-passkey-authentication-bypass-in-strongkey-fido-server · Note
• https://twitter.com/CVEnew/status/1890322723395747867 · Twitter Post
• https://docs.strongkey.com/index.php/skfs-v3/skfs-release-notes · Note
• https://twitter.com/CveFindCom/status/1890310515546546397 · Twitter Post
• https://reddit.com/r/Passkeys/comments/1mbh9xl/passkeys_are_dead_to_me_from_now_on · Reddit Post