SB2024071402 - Observable Response Discrepancy in Webauthn Framework

Description

This security bulletin contains information about 1 vulnerability.

1) Observable Response Discrepancy (CVE-ID: CVE-2024-39912)

CWE-ID: CWE-204 - Observable Response Discrepancy

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to enumerate valid usernames.

The vulnerability exists due to observable response discrepancy in ProfileBasedRequestOptionsBuilder when handling assertion options requests with a supplied username. A remote attacker can send a specially crafted request to enumerate valid usernames.

The issue is exposed when WebAuthn is used as the first or only authentication method.

Remediation

Install update from vendor's website.

References

• https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-875x-g8p7-5w27
• https://github.com/advisories/GHSA-875x-g8p7-5w27