CVE-2025-26788StrongKey FIDO Server credential-type confusion, passkey bypass
What broke
StrongKey FIDO Server (4.10.0 through 4.15.0) mixed up discoverable and non-discoverable credentials. The server would accept an assertion for the wrong credential type and authenticate the attacker as the victim. High. StrongKey patched.
Why it matters
On-prem FIDO2 servers are how regulated environments get passkeys without sending every ceremony to a cloud IdP. A credential-type confusion is a passkey auth bypass with no phishing required. It is the server-side cousin of CVE-2026-34348 (logging) and of Keycloak's fmt:none attestation-policy bypass.
What to do
- Upgrade StrongKey FIDO Server off the 4.10-4.15 line.
- Confirm your FIDO server still distinguishes resident / discoverable keys from server-side credentials after the upgrade.
- Review authentication logs for ceremonies that succeeded with an unexpected credential type.
After you patch
Flaws in the phishing-resistant layer are serious precisely because the resulting authentication satisfies your strongest policy.
- Hunt for authentications with an empty device ID or with no matching interactive session on the originating host, accepting that some legitimate traffic looks similar.
- Review registered authenticators and devices for enrolments you did not expect, which is the persistence step in this class.
- Re-enrol credentials for privileged accounts if assertion material may have been exposed, and prefer device-bound hardware authenticators for those users.
- Verify server-side user verification checks, since accepting an assertion with the flag unset removes the property you deployed passkeys for. See WebAuthn and FIDO2.
Sources
Related identity CVEs
Related on Start with Identity
- GlossaryPasswordless
Authentication without a password as a primary factor. Implementations include magic links, OTP codes, and passkeys. Passkeys are the only passwordless method t
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- GlossaryBiometric Authentication
Biometric authentication confirms a person by comparing a live measurement of a physical characteristic, such as a fingerprint or face, against a template captu
- GlossaryMFA
MFA (multi-factor authentication) is sign-in that requires two or more factors from different categories: something you know (a password or PIN), something you
- Blog24,650 exposed server management interfaces leak crackable password hashes before login
Firmware security firm Lava found that 67 percent of 36,872 internet-exposed Baseboard Management Controllers hand over IPMI authentication hashes before a logi
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
Technique
This CVE is an instance of Token replay against an unbound endpoint. A token that is not bound to the client, session, or challenge that requested it can be lifted once and replayed anywhere the check for binding is missing, no matter how it was strengthened.