1. Home
  2. CVE Database
  3. CVE-2023-44039
CRITICAL · 9.1

CVE-2023-44039

In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO key) to register their FIDO authenticato...

Vulnerability Description

In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO key) to register their FIDO authenticator to a victim’s account and consequently take over the account.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
VeridiumidVeridiumad< 3.5.0

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2023-44039?

CVE-2023-44039 is a vulnerability with a CVSS score of 9.1 (CRITICAL). In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO key) to register their FIDO authenticato...

How severe is CVE-2023-44039?

CVE-2023-44039 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2023-44039?

Check the references section above for vendor advisories and patch information. Affected products include: Veridiumid Veridiumad.