CVE-2025-26788StrongKey FIDO Server credential-type confusion, passkey bypass
What broke
StrongKey FIDO Server (4.10.0 through 4.15.0) mixed up discoverable and non-discoverable credentials. The server would accept an assertion for the wrong credential type and authenticate the attacker as the victim. High. StrongKey patched.
Why it matters
On-prem FIDO2 servers are how regulated environments get passkeys without sending every ceremony to a cloud IdP. A credential-type confusion is a passkey auth bypass with no phishing required. It is the server-side cousin of CVE-2026-34348 (logging) and of Keycloak's fmt:none attestation-policy bypass.
What to do
- Upgrade StrongKey FIDO Server off the 4.10-4.15 line.
- Confirm your FIDO server still distinguishes resident / discoverable keys from server-side credentials after the upgrade.
- Review authentication logs for ceremonies that succeeded with an unexpected credential type.
After you patch
Flaws in the phishing-resistant layer are serious precisely because the resulting authentication satisfies your strongest policy.
- Hunt for authentications with an empty device ID or with no matching interactive session on the originating host, accepting that some legitimate traffic looks similar.
- Review registered authenticators and devices for enrolments you did not expect, which is the persistence step in this class.
- Re-enrol credentials for privileged accounts if assertion material may have been exposed, and prefer device-bound hardware authenticators for those users.
- Verify server-side user verification checks, since accepting an assertion with the flag unset removes the property you deployed passkeys for. See WebAuthn and FIDO2.
Sources
Related identity CVEs
Related on Start with Identity
- GlossaryPasswordless
Authentication without a password as a primary factor. Implementations include magic links, OTP codes, and passkeys. Passkeys are the only passwordless method t
- GlossaryMFA
Multi-Factor Authentication. Requiring two or more factors from distinct categories: something you know (password), something you have (token), something you ar
- GlossaryPasskey
A passkey is a WebAuthn public-key credential that replaces a password. Possession of the authenticator plus a user verification step proves identity, with no s
- Blog24,650 exposed server management interfaces leak crackable password hashes before login
Firmware security firm Lava found that 67 percent of 36,872 internet-exposed Baseboard Management Controllers hand over IPMI authentication hashes before a logi
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- BlogEvery on-premises TeamCity server is vulnerable to an auth bypass in the agent polling protocol
CVE-2026-63077 lets an unauthenticated attacker abuse TeamCity's agent polling protocol to bypass authentication and run arbitrary OS commands with the server p
Technique
This CVE is an instance of Token replay against an unbound endpoint. A token that is not bound to the client, session, or challenge that requested it can be lifted once and replayed anywhere the check for binding is missing, no matter how it was strengthened.