Description
Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| diced | zipline | ≤ 4.4.0 | — |
References
- GitHub Security Advisory (GHSA-8g3f-425r-35rq) vendor-advisory
- VulnCheck Advisory: Zipline through 4.4.0 WebAuthn Authentication Bypass via Passkey Login third-party-advisory