{"answers":{"affected":"2 open source packages ship an affected version, including @simplewebauthn/server.","exploited":"There is no known exploitation of GHSA-6hxq-p678-4hr2 in the wild and no public exploit code.","fix":"Upgrade @simplewebauthn/server to 13.3.2 or later.","what":"GHSA-6hxq-p678-4hr2 is a vulnerability in @simplewebauthn/server, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-6hxq-p678-4hr2 and fix it if it is affected.\n\nWhat it is: GHSA-6hxq-p678-4hr2 is a vulnerability in @simplewebauthn/server, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-6hxq-p678-4hr2 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @simplewebauthn/server (npm): affected all versions; fixed in 13.3.2\n- @simplewebauthn/server (npm): affected all versions; fixed in 13.3.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-6hxq-p678-4hr2/ (Markdown: https://insights.sbomify.com/GHSA-6hxq-p678-4hr2/index.md)","id":"GHSA-6hxq-p678-4hr2","markdown":"https://insights.sbomify.com/GHSA-6hxq-p678-4hr2/index.md","name":"GHSA-6hxq-p678-4hr2","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"WebAuthn library","requires_auth":"none","summary":"Attackers can bypass WebAuthn attestation verification by supplying a self-signed certificate, allowing registration of unverified credentials.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n`validateCertificatePath()` does not verify that an attestation's certificate chain actually terminates at a configured trust anchor. When walking the chain it stops at the first self-signed certificate it finds (which could be user-supplied), and exits early.\n\nThis happens before the configured Apple/Google/etc trust anchor (which is concatenated to the end of the chain) is reached.\n\nA user can therefore register a credential and have the server accept it as if it were backed by a genuine Apple / Android SafetyNet / Yubikey / etc.\n\n## Details\n`packages/server/src/helpers/validateCertificatePath.ts`:\n\nThe configured trust anchor is appended to the end of the untrusted chain (line **83**):\n\n```ts\nconst x5cWithTrustAnchor = x5cCertsParsed.concat([anchor]);\n```\n\nThe walk then verifies each cert was signed by the next, but breaks on the first self-signed cert (lines **104–116**):\n\n```ts\nif (issuer.subject === issuer.issuer) {\n  // Root cert detected, make sure it signed itself\n  const issuerSignedIssuer = await issuer.verify(\n    { publicKey: issuer.publicKey, signatureOnly: true },\n    WebCrypto,\n  );\n  if (!issuerSignedIssuer) {\n    throw new InvalidSubjectAndIssuer();\n  }\n  break;   // \u003c-- exits before the appended trust anchor is ever checked if user supplied self-signed cert comes first\n}\n```\n\nThe success condition is therefore \"the certs form an internally-consistent chain ending in some self-signed cert\" Rather than \"the chain terminates at one of the configured trust anchors.\"\n\n## Exploit shape\n\n```\nattacker sends:  x5c = [ forgedLeaf (signed by attacker root),\n                         attackerSelfSignedRoot ]\n\nlibrary builds:  [ forgedLeaf, attackerSelfSignedRoot, \u003cconfigured Apple/Google/etc root\u003e ]\n\nwalk:  forgedLeaf -\u003e attackerSelfSignedRoot        (verifies, attacker controls both)\n       attackerSelfSignedRoot is self-signed        -\u003e break\n       attackerSelfSignedRoot -\u003e configured root    (NEVER CHECKED)\n```\n\n`return true`. The configured anchor never gets checked.\n\nAs far as observed, all attestation enforcement uses validateCertificatePath when using MDS etc.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"`validateCertificatePath()` does not verify that an attestation's certificate chain actually terminates at a configured trust anchor.","id":"GHSA-6hxq-p678-4hr2","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["13.3.2"],"introduced":["0"],"last_affected":[],"package":"@simplewebauthn/server","purl":null,"source":"GHSA-6hxq-p678-4hr2"},{"ecosystem":"npm","fixed":["13.3.2"],"introduced":["0"],"last_affected":[],"package":"@simplewebauthn/server","purl":"pkg:npm/%40simplewebauthn/server","source":"GHSA-6hxq-p678-4hr2"}],"products":null,"published":"2026-09-04","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can bypass WebAuthn attestation verification by supplying a self-signed certificate, allowing registration of unverified credentials.","url":"https://insights.sbomify.com/GHSA-6hxq-p678-4hr2/"}