PT-2026-22998 · Unknown+1 · @Simplewebauthn/Server+1

Dorakemon

·

Published

2026-03-02

·

Updated

2026-03-11

·

CVE-2026-28787

CVSS v3.1

9.0

Critical

VectorAV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions OneUptime versions 10.0.11 and prior
Description The WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during verification, violating the WebAuthn specification. This allows an attacker who has obtained a valid WebAuthn assertion (e.g., via XSS, MitM, or log exposure) to replay it indefinitely, bypassing the second-factor authentication. The server generates a challenge using the generateAuthenticationOptions() function in Common/Server/Services/UserWebAuthnService.ts. The server reads the expectedChallenge directly from the request body at /api/identity/authentication/login. The verifyAuthentication() method then passes this client-provided challenge to @simplewebauthn/server’s verifyAuthenticationResponse(). This allows an attacker to replay a captured assertion by sending a request containing the victim’s email, password, and the captured challenge and credential.
Recommendations Versions prior to 10.0.11 should be updated when a fix is available. As a temporary workaround, consider disabling WebAuthn authentication until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-294CWE-287

Related Identifiers

CVE-2026-28787
GHSA-GJJC-PCWP-C74M

Affected Products

@Simplewebauthn/Server
Oneuptime