GHSA-v9hx-v6vf-g36j

    Dashboard / Vulnerabilities / GHSA-v9hx-v6vf-g36j

    GHSA-v9hx-v6vf-g36j

    Published: 17 Oct 2023Last Modified: 10 Sept 2026

    Summary: WebAuthn4J Spring Security Improper signature counter value handling

    Details: Improper signature counter value handling ### Impact A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. ### Patches Please upgrade to `com.webauthn4j:webauthn4j-spring-security-core:0.9.1.RELEASE` ### References For more details about WebAuthn signature counters, see [WebAuthn specification 6.1.1. Signature Counter Considerations](https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-sign-counter). ### Reporter This issue was discovered by Michael Budnick (@mbudnick)

    References: https://github.com/webauthn4j/webauthn4j-spring-security/security/advisories/GHSA-v9hx-v6vf-g36j, https://nvd.nist.gov/vuln/detail/CVE-2023-45669, https://github.com/webauthn4j/webauthn4j-spring-security/commit/129700d74d83f9b9a82bf88ebc63707e3cb0a725, https://github.com/webauthn4j/webauthn4j-spring-security, https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-sign-counter

    Affected packages

    Package

    Name: com.webauthn4j:webauthn4j-spring-security-core

    Purl: pkg:maven/com.webauthn4j/webauthn4j-spring-security-core

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.9.1.RELEASE

    Affected versions

    0.7.0.RELEASE
    0.7.1.RELEASE
    0.7.2.RELEASE
    0.7.3.RELEASE
    0.7.4.RELEASE
    0.7.5.RELEASE
    0.7.6.RELEASE

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-v9hx-v6vf-g36j | CVE-DB