CVE-2026-46419

Published: May 14, 2026Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: MITRE (Secondary)

Description

Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.

Related CWEs

CWE-253

Incorrect Check of Function Return Value

The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

References (2)

https://github.com/Yubico/java-webauthn-server/releases/tag/2.8.2

Source: cve@mitre.org

https://www.yubico.com/support/security-advisories/ysa-2026-02/

Source: cve@mitre.org

Timeline

No history available yet.