AIKIDO-2026-428599

TL;DR

Fido2's assertion verifier accepts an authenticator assertion whose signCount is 0 even when the stored signature counter for the credential is non-zero. The clone detection check only runs when the reported signCount is greater than zero, so a cloned or replaying authenticator that reports a zero counter skips the WebAuthn clone detection branch. This lets a captured or duplicated credential keep authenticating without the server flagging it as a possible clone. The fix enters the clone detection branch whenever the stored counter is non-zero, regardless of the reported counter value.