Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
CVE-2023-45669: webAuthn4j Spring Security may fail to spot cloned keys
CVE-2023-45669 · published 3 years ago
Summary
The webauthn4j-spring-security-core library does not correctly save the authenticator’s signature counter when it increases, so it cannot detect a copied security key. An attacker using a cloned key could log in without being noticed. Upgrade to version 0.9.1.RELEASE as soon as possible; there are no other fixes.
What to do
- Update webauthn4j com.webauthn4j:webauthn4j-spring-security-core to version 0.9.1.RELEASE.
- Update webauthn4j spring_security to version 0.9.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | webauthn4j | com.webauthn4j:webauthn4j-spring-security-core |
< 0.9.1.RELEASE Fix: upgrade to 0.9.1.RELEASE
|
| – | webauthn4j | spring_security |
< 0.9.1 cpe:2.3:a:webauthn4j:spring_security:*:*:*:*:*:spring:*:* |
Original advisory text
Improper signature counter value handling in webauthn4j-spring-security
WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version `0.9.1.RELEASE`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References
- https://github.com/advisories/GHSA-v9hx-v6vf-g36j
- https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-sign-counter URL
- https://github.com/webauthn4j/webauthn4j-spring-security/security/advisories/GHS... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-45669 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45669... Vendor Advisory
- https://github.com/webauthn4j/webauthn4j-spring-security/commit/129700d74d83f9b9... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-287Improper Authentication
Timeline
Published16 Oct 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta