AIKIDO-2026-716832
@cedarjs/auth-dbauth-api is vulnerable to Authentication Bypass
98
Critical Risk
This Affects:
@cedarjs/auth-dbauth-apiTL;DR
DbAuthHandler.webAuthnAuthenticate() in dbAuth verifies a WebAuthn assertion but does not act on a failed verification result. When verifyAuthenticationResponse() returns verified: false for a signature that does not match the stored public key, the handler still updates the credential counter and issues the login session cookies. An unverified assertion is therefore answered with a valid session for the credential's owner. The fix throws a WebAuthnError before any credential update or cookie issuance when the assertion is not verified.
Who does this affect?
You are affected if you are using a version that falls within a vulnerable range and you use dbAuth's WebAuthn login.
Background info
@cedarjs/auth-dbauth-api is vulnerable to Authentication Bypass in versions 0.0.4 - 5.0.6 and 6.0.0 - 6.0.0.
How to fix this
Upgrade the @cedarjs/auth-dbauth-api library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.