Vulnerability Description
If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability was fixed in Firefox 140 and Thunderbird 140.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 140.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1954033Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2025-51/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-54/
FAQ
What is CVE-2025-6433?
CVE-2025-6433 is a vulnerability with a CVSS score of 9.8 (CRITICAL). If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in vio...
How severe is CVE-2025-6433?
CVE-2025-6433 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-6433?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox.