CVE-2023-45669

Summary

CVE-2023-45669 affects WebAuthn4J Spring Security, a library used for Web Authentication specification support in Spring applications. The vulnerability involves improper handling of signature counter values during authentication. When an authenticator returns an incremented signature counter value, webauthn4j-spring-security-core fails to properly persist it, making cloned authenticator detection ineffective. As a result, an attacker who clones a valid authenticator can use it undetected. The issue is resolved in version 0.9.1.RELEASE, and users are urged to upgrade as soon as possible. No known workarounds exist for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.