Start with Identity
Identity CVE · FIDO2 / WebAuthn

CVE-2025-26788StrongKey FIDO Server credential-type confusion, passkey bypass

high
Product: StrongKey FIDO ServerVendor: StrongKeyDisclosed: 2025-02-18Status: PatchedProtocol deep diveNVD ↗

What broke

StrongKey FIDO Server (4.10.0 through 4.15.0) mixed up discoverable and non-discoverable credentials. The server would accept an assertion for the wrong credential type and authenticate the attacker as the victim. High. StrongKey patched.

Why it matters

On-prem FIDO2 servers are how regulated environments get passkeys without sending every ceremony to a cloud IdP. A credential-type confusion is a passkey auth bypass with no phishing required. It is the server-side cousin of CVE-2026-34348 (logging) and of Keycloak's fmt:none attestation-policy bypass.

What to do

  • Upgrade StrongKey FIDO Server off the 4.10-4.15 line.
  • Confirm your FIDO server still distinguishes resident / discoverable keys from server-side credentials after the upgrade.
  • Review authentication logs for ceremonies that succeeded with an unexpected credential type.

After you patch

Flaws in the phishing-resistant layer are serious precisely because the resulting authentication satisfies your strongest policy.

  • Hunt for authentications with an empty device ID or with no matching interactive session on the originating host, accepting that some legitimate traffic looks similar.
  • Review registered authenticators and devices for enrolments you did not expect, which is the persistence step in this class.
  • Re-enrol credentials for privileged accounts if assertion material may have been exposed, and prefer device-bound hardware authenticators for those users.
  • Verify server-side user verification checks, since accepting an assertion with the flag unset removes the property you deployed passkeys for. See WebAuthn and FIDO2.

Sources

Last reviewed By SWI Community TeamSuggest a correctionHow we research

Technique

This CVE is an instance of Token replay against an unbound endpoint. A token that is not bound to the client, session, or challenge that requested it can be lifted once and replayed anywhere the check for binding is missing, no matter how it was strengthened.

Know a primary source we should add, or a patch status that has changed? Email community@startwithidentity.com. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.