AIKIDO-2026-629661
Fido2 is vulnerable to Improper Certificate Validation
75
High Risk
This Affects:
Fido2TL;DR
Fido2's attestation verification builds and checks the authenticator's X.509 certificate trust chain against FIDO metadata service trust anchors during registration. The chain validation does not fully enforce trust chain and revocation checks, so a forged or invalid attestation certificate chain can pass verification. This lets a non-genuine or unauthorized authenticator register as trusted hardware when the relying party asks for attestation. The fix adds certificate revocation list handling and tightens trust anchor chain validation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you verify authenticator attestation statements, such as with direct or indirect attestation conveyance.
Background info
Fido2 is vulnerable to Improper Certificate Validation in versions 0.0.1 - 4.1.1.
How to fix this
Upgrade the Fido2 and/or the Fido2.AspNet library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.